Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#101

Post by chris_overseas »

the_french wrote: post #89
chris_overseas wrote: post #80

One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characters long(!) consisting only of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password: https://banking.westpac.com.au/ I complained to them about this…

Even worse, a major French bank removed their perfectly fine password requirements and replaced it with a 6 digit PIN that you have to enter via an on-screen numpad. They explicitly block password managers from autofilling too! And I had just managed to get my parents to start using one.

Well Westpac had an onscreen keyboard for the password entry too until about 18 months ago. When they finally replaced it with a (thankfully password-safe friendly) text box they had this to say:

"At Westpac, we are continually striving to provide the highest quality service and security to help support our Online Banking customers.

From the end of May 2018, we will be removing the keypad from the online sign-in screen and replacing it with an open text box, which allows you to type in your Customer ID and password.

...

Security Guarantee. We assure you that using the open text box to enter your sign-in details carries the same high level of security ..."

Passwords remained fixed at 6 characters however.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#102

Post by ncallaway »

plsdonthack wrote: post #63
Urgo wrote: post #45

If this is really happening this is a serious issue that needs to be fixed ASAP and everyone alerted.. but.. something doesn't look right here.. OP is a throwaway account created today, which I can understand for this type of thing.. but... they withheld the bank name in the title/desc.. okay again a responsible thing to do.. but... when asked what the bank name was in the comments they were not shy at naming it.. So…

Unfortunately I'm not awake at all hours of the day to respond to internet comments. But if you want further evidence that their passwords are indeed stored in plaintext, consider that their password rule prohibits the special characters !, /, \, , etc. You can verify that yourself.

How is that evidence of plaintext storage?

Couldn't they do that validation before they hash the password, but still store a hash?

I'm not saying they don't store plaintext, but restricted character's are absolutely not incompatible with hashed passwords.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#103

Post by thinkingemote »

prklmn wrote: post #35
altcognito wrote: post #32

Earlier quoted context omitted.

Or don't make financial decisions based on vague anonymous internet comments until you've investigated for yourself.

Do you want this person to mount a full blast investigation on their own? Most banks are mostly interchangeable nowadays unless you live in a small town and there’s only one bank you must use because you’re transacting with cash. They pay nearly zero interest, and they treat their customers like trash with monthly fees galore.

Thank you, yes I will certainly change all my financial set up based on no further information these two alarming comments. Who needs to look further into things - they are all the same after all.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#104

Post by drenginian »

Just do a Tell HN: Bank of Foogistan stores passwords in plain text.

Don’t agonize about it so much it’s not like you’re going to hurt the banks feelings.

No one will notice or care anyway and banks deserve what they get if they do this.

And if the bank does pay attention they’ll just fix it and move on. Don’t know why you feel this is such a big deal.

Who would you tell that would even care? I can’t imagine the police jumping into their car with sirens screaming. “I wish to report a terrible crime”.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#105

Post by wj »

Wells Fargo used to require that a new password be sufficiently different from an old password. e.g. if my password was "Madison111$" I could change it to "Madison222$" except that when I did so I would be prompted to change it again the next time I logged in. Since I always iterated on a version of my password this was an issue. The reason was explained to me when I finally called and asked why I was being required to change my password every single time I logged in. So, I changed Madison to Matthew and was good to go.

Not sure how they were doing that if they weren't storing the password in plaintext.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#107

Post by apocalyptic0n3 »

wj wrote: post #105

Wells Fargo used to require that a new password be sufficiently different from an old password. e.g. if my password was "Madison111$" I could change it to "Madison222$" except that when I did so I would be prompted to change it again the next time I logged in. Since I always iterated on a version of my password this was an issue. The reason was explained to me when I finally called and asked why I was being required…

It is definitely possible to do that. When the user submits a password to save, it hashes it and saves it to the database. At the same time, it calculates x number of variations of the passwords, hashes those, and saves those to the database as well. The next time you go to update your password, the hash gets compared against the actual previous hash as well as the x number of hashed variations and if any match, it gets rejected.

Not super efficient and in most cases, probably not worth the effort. But completely doable to do.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#108

Post by Eric_WVGG »

wj wrote: post #105

Wells Fargo used to require that a new password be sufficiently different from an old password. e.g. if my password was "Madison111$" I could change it to "Madison222$" except that when I did so I would be prompted to change it again the next time I logged in. Since I always iterated on a version of my password this was an issue. The reason was explained to me when I finally called and asked why I was being required…

they could do it without plaintext by storing hash(/^[a-zA-Z]+$/)

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#109

Post by bodhi_mind »

Hashing passwords has been ingrained into our brains as it's an easy way to reduce risk. That said, sometimes sensitive information needs to be stored in a retrievable format (subscription credit card processing comes to mind). Every data decision that's made has an element of risk involved while accomplishing an end goal. With the right processes in place (encryption, limiting access (auditing that access), decryption authorization), the risk can be reduced to an acceptable level.

I don't think we have enough knowledge of the risk and processes in place at this bank to say if it's an issue.

Post reply on HN