91–100 of 328 posts
Still awful, but not as awful.
Earlier quoted context omitted.
Is it not possible to verify positional characters without storing in plain text ? off the top of my head, something like storing your full password salted + hashed along side each char salted + hashed.
If you store an individual character hashed then it is trivial to brute force it. I don't think there is a bcrypt work factor that you could use that would prevent brute forcing but would allow the individual character to be used for authentication.
One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characters long(!) consisting only of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password: https://banking.westpac.com.au/ I complained to them about this…
Wow. Did they repeat your password or some hint you typed in a long time ago? FWIW I have seen two companies that store passwords properly in a one way hash with salt but store statistics on every password like number of case changes and count of numbers and total length. I personally think that practice is infinitely stupid but can explain why they can say it has 3 numbers in it. One major marketing firm I did work…
They're a three letter acronym that starts with P and ends with C.
Or tolower() everywhere.
If it's true that they're able to read it back though, then why would they bother?
> The service rep proceeded to (accurately) describe my own password to me. Wait, that alone doesn't necessarily indicate that they're storing clear text passwords. I notice you didn't say that they just repeated your password to you-- why do you think they store the whole thing in clear text? HN readers are apt to demand hardcore passphrases, salting, 2FA, etc. But the reality is that banks have to deal with all kin…
> Is there a law against clear text passwords In Europe GDPR covers that, many big websites started hashing after it Edit: could somebody explain the downvotes? The comments seem to agree with me Obviously GDPR is not a law about plain text passwords, but as the comments say it forces "the use of an appropriate hashing algorithm to store your passwords, protecting the means by which users enter their passwords, defen…
Edit: Kind of. The UK org in charge of GDPR says:
> Although the GDPR does not say anything specific about passwords, you are required to process personal data securely by means of appropriate technical and organisational measures.
> Passwords are a commonly-used means of protecting access to systems that process personal data. Therefore, any password setup that you implement must be appropriate to the particular circumstances of this processing.
> There are a number of additional considerations you will need to take account of when designing your password system, such as the use of an appropriate hashing algorithm to store your passwords, protecting the means by which users enter their passwords, defending against common attacks and the use of two-factor authentication.
https://ico.org.uk/for-organisations/guide-to-data-protectio...
I was thinking maybe Capital One?
Earlier quoted context omitted.
Yes I don't care how they do it as long as they can protect my money. Likewise, they may use top of the line, super secure lock but if they can't protect my money, I wouldn't use them.
> Yes I don't care how they do it as long as they can protect my money. That is like saying I don't care about having a bucket of water thrown on me as long as I don't get wet.
> The service rep proceeded to (accurately) describe my own password to me. Wait, that alone doesn't necessarily indicate that they're storing clear text passwords. I notice you didn't say that they just repeated your password to you-- why do you think they store the whole thing in clear text? HN readers are apt to demand hardcore passphrases, salting, 2FA, etc. But the reality is that banks have to deal with all kin…
> Is there a law against clear text passwords In Europe GDPR covers that, many big websites started hashing after it Edit: could somebody explain the downvotes? The comments seem to agree with me Obviously GDPR is not a law about plain text passwords, but as the comments say it forces "the use of an appropriate hashing algorithm to store your passwords, protecting the means by which users enter their passwords, defen…
The most relevant passage is "the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk" from article 32; and it could be argued that having passwords in plaintext most likely does not constitute "appropriate technical measures" and doing so opens you up to fines based on GDPR if an incident occurs, but it's not really "a law against clear text passwords" but rather a law that simply says that you are responsible for how you [mis]implement your security and the consequences of that.
Some people have noted that they might store part of your password, but they could also be using some sort of master key to encrypt their passwords. Meaning they can also decrypt them and provide a UI for their help desk. Still awful, but not as awful.
Why not reach out to someone like Brian Krebs? He has a pretty large reach and can potentially make people take notice. Try @briankrebs on Twitter.
Alternatively I feel like Troy Hunt may also be able to help https://twitter.com/troyhunt He runs the @haveibeenpwned service
https://www.troyhunt.com/banks-arbitrary-password-restrictio...
His viewpoint seems to be that poor security practices around passwords in banks are not a big deal, due to the overall processes that banks use to prevent fraud.