Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#111

Post by matz1 »

afarrell wrote: post #73
matz1 wrote: post #50

Earlier quoted context omitted.

Sure, If the doctor can deliver baby safely and not causing any other damage despite not washing hands then what's the issue? That's why I asked what is the actual damage. Is the money is stolen ? Is the money can't be accessed ? If the bank doesn't do me any actual damage despite the clear text password then I don't see why I should be concerned. I guess I can see that for some people, clear text password usage can…

Are you genuinely saying that when you see someone putting you at risk, that you do not see a problem with it until a problem actually occurs? Imagine you worked in a building for a week and didn’t die in a fire. Would you have a problem with discovering that the writing was done by a amateur, there were piles of lint and fabric everywhere, and there was only one revolving-door exit? If yes, then you understand the p…

The risk are highly exaggerated, the damage may never occurs in the first place.

It may seem unlikely that the bank can keep my money save by using plain text pwd but if they can somehow do that, why do I care.

Even in the unlikely event that the money is stolen but if the bank can handle that without causing me disruption then whats the issue.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#112

Post by efa »

chris_overseas wrote: post #80

One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characters long(!) consisting only of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password: https://banking.westpac.com.au/ I complained to them about this…

Looks like they are using Fiserv (lots of Fiserv references in the code). Fiserv is a huge provider of banking services. If Fiserv is requiring these ridiculous id/pw requirements that would be even more scary.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#113

Post by efa »

efa wrote: post #112
chris_overseas wrote: post #80

One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characters long(!) consisting only of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password: https://banking.westpac.com.au/ I complained to them about this…

Looks like they are using Fiserv (lots of Fiserv references in the code). Fiserv is a huge provider of banking services. If Fiserv is requiring these ridiculous id/pw requirements that would be even more scary.

https://krebsonsecurity.com/tag/fiserv/

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#114

Post by diffeomorphism »

matz1 wrote: post #97
diffeomorphism wrote: post #57

Earlier quoted context omitted.

> Yes I don't care how they do it as long as they can protect my money. That is like saying I don't care about having a bucket of water thrown on me as long as I don't get wet.

Heres another analogy, I've been using a black box sorting function from third party library, its super fast and satisfied all my requirements. Then they told me they implemented it using . From my perspective, as long is doing a good job and works as I expected, I don't care how its implemented.

..., but I don't care how it is implemented as long as it is secure.

I totally agree with this part. The problem is that the security of the implementation is the security of the implementation. So your sentence reads:

This is implemented extremely insecurely, but I don't care how it is implemented as long as it is secure. I also don't care about water, as long as it is dry.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#115

Post by StavrosK »

apocalyptic0n3 wrote: post #107
wj wrote: post #105

Wells Fargo used to require that a new password be sufficiently different from an old password. e.g. if my password was "Madison111$" I could change it to "Madison222$" except that when I did so I would be prompted to change it again the next time I logged in. Since I always iterated on a version of my password this was an issue. The reason was explained to me when I finally called and asked why I was being required…

It is definitely possible to do that. When the user submits a password to save, it hashes it and saves it to the database. At the same time, it calculates x number of variations of the passwords, hashes those, and saves those to the database as well. The next time you go to update your password, the hash gets compared against the actual previous hash as well as the x number of hashed variations and if any match, it g…

How many variations will you store? It's very easy to calculate the Levenshtein distance on plaintext data, but basically impossible to enumerate all the variants and hash them.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#116

Post by cpv »

wtmt wrote: post #70
_Understated_ wrote: post #62

Why not reach out to someone like Brian Krebs? He has a pretty large reach and can potentially make people take notice. Try @briankrebs on Twitter.

This is the best way to go about it if people at the bank aren’t responding. Nobody likes a PR nightmare, and Brian Krebs can handle this better with the right people if the OP provides enough evidence.

"Almost without fail at each engagement multiple C-level folks will approach after my talk, hand me their business cards and say something like, “I hope you never have to use this, but if you do please call me first.”"

https://krebsonsecurity.com/2019/12/ciso-magazine-honors-kre...

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#117

Post by slumdev »

Name and shame. I'll start:

American Express passwords are not case sensitive.

It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#118

Post by coenhyde »

bodhi_mind wrote: post #109

Hashing passwords has been ingrained into our brains as it's an easy way to reduce risk. That said, sometimes sensitive information needs to be stored in a retrievable format (subscription credit card processing comes to mind). Every data decision that's made has an element of risk involved while accomplishing an end goal. With the right processes in place (encryption, limiting access (auditing that access), decrypti…

I think you're prematurely jumping to the defense of this bank. What we do know is that the customer service rep was able to read the user's password in plaintext. Even if there is a "legitimate" reason for storing in a retrievable format (probably due to compatibility with legacy systems) the fact that the customer service rep could access that password tells me they do not have appropriate access control.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#119

Post by thdrdt »

Can you explain what you mean with "describe my own password to me".

As other point out: maybe they store some things about your password like "has four digits, starts with an S".

This does not mean they store your password in plain text.

Everybody here starts shaming and naming but be very careful with that. Before you know it you shame a company while there is nothing going on.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#120

Post by anbr »

dx87 wrote: post #93
chris_overseas wrote: post #80

One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characters long(!) consisting only of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password: https://banking.westpac.com.au/ I complained to them about this…

A company that my retirement plan used to be with was worse than that. The password could only be numbers and letters, and they would silently truncate your password to 8 characters. The worst part though, is the password was stored in a way that it could be entered on a touch tone phone. So case was silently ignored for letters, and the characters "2abcABC" were all stored as the number 2, and so on for the rest of…

All major telecos in Spain do the same. One of the largest asks you to set up only a 6-digit PIN to access the customer portal and no 2FA. They send you your PIN by SMS as a confirmation. All your invoices (with the details of the numbers you called) as well as other personal details, are "protected" by a 6-digit PIN. I want to think they have other protection mechanisms in place, but I seriously doubt it.
Post reply on HN