131–140 of 328 posts
Move your money. Support your local/regional banks.
The password is probably encrypted using a two-way hash. It's not as secure as a one-way has, but you can't see passwords by running a SQL query.
The password is probably encrypted using a two-way hash. It's not as secure as a one-way has, but you can't see passwords by running a SQL query.
Earlier quoted context omitted.
> Is there a law against clear text passwords In Europe GDPR covers that, many big websites started hashing after it Edit: could somebody explain the downvotes? The comments seem to agree with me Obviously GDPR is not a law about plain text passwords, but as the comments say it forces "the use of an appropriate hashing algorithm to store your passwords, protecting the means by which users enter their passwords, defen…
GDPR does not have any wording that refers to any technical specifics (e.g. password storage) whatsoever. The most relevant passage is "the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk" from article 32; and it could be argued that having passwords in plaintext most likely does not constitute "appropriate technical…
https://www.gamingtechlaw.com/2019/04/first-gdpr-fine-italy.... this fine specifically mentions password storage (among many other things)
Also see previous thread on HN: https://news.ycombinator.com/item?id=18531588
Banking security is a joke. My bank calls me to talk to me and insists I give them my date of birth and address to ‘verify’ myself. Meaning anyone can call me, pretend to be my bank, I am supposed to give them this info, and then they have what they need to verify themself as me. Banks are dumb.
I did some tech consulting with some ex-banking Wall St. consultants. It's not a monolith. That industry is very conservative.. and some companies get so frozen in time that they become complacent and go full Equifax. They're always playing catch-up because every criminal and most people would like to rob a bank without a gun, so their threats are numerous and perpetual. (And then there's Wells Fargo.) It seems like…
I've seen this on multiple sites, and I always thought it was snakeoil. All you need to do to bypass it would be to make your phishing server contact tho bank to request the per-customer color/picture/word.
Do you really think the only thing the bank does to log people on is to check the username and password? Banks are way more sophisticated than this and it goes well beyond merely string-matching credentials; there's all sorts of other environment, behavioral and heuristic patterns used to establish legitimacy. Even if you rose this issue with the bank, they'll hardly change their modes of operation, and you certainly…
Which is totally bullshit because I have RFP enabled in firefox, and I get asked for my security question on every log in, even though my password is randomly generated and reasonably secure.
Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.
Lol it's been that way for at least 20 years. Same with chase (well at least the bank one half of it). It seems remarkably stupid, but it's way cheaper for them to refund any losses and/or pay for lifetime credit monitoring than it is to deal with customer service calls from people getting locked out because they can't figure out how to deal with uppercase and lowercase letters.
For the other banks, the motivation is harder to understand.
Hashing passwords has been ingrained into our brains as it's an easy way to reduce risk. That said, sometimes sensitive information needs to be stored in a retrievable format (subscription credit card processing comes to mind). Every data decision that's made has an element of risk involved while accomplishing an end goal. With the right processes in place (encryption, limiting access (auditing that access), decrypti…
I think you're prematurely jumping to the defense of this bank. What we do know is that the customer service rep was able to read the user's password in plaintext. Even if there is a "legitimate" reason for storing in a retrievable format (probably due to compatibility with legacy systems) the fact that the customer service rep could access that password tells me they do not have appropriate access control.
What is a secure hypothetical way of granting access to an account when the customer lost access to their email and phone (so no pw reset or 2 factor authentication will work)?
The bank has to have other processes in place. They're not going to keep your money from you. Let's say they accept a driver's license as authentication or a debit card. These methods are way less secure than a secret password and possibly introduce more security risk than a rep having access to view a password.
A bad actor rep could then [almost] just as easily get a fake ID created to get the same access the password would have granted. I'm also assuming that the password was completely visible, not just a truncated version.
This is the root of my concern of not knowing all the risks and processes involved. I don't want to jump to conclusions without knowing the whole ecosystem.
The risk analysis and mitigation discussion for these institutions goes something like this:
1) We cant have good password storage so we will require a 2nd factor and attempt to ensure these systems reside in our most secure network.
2) There is nothing we can do, so we will simply rely on the fact that if someone logs into an account illegally, we send in the men with guns. For some strange reason when a bank calls the FBI things move with a high level of expediency.
There is much more to this than just the technical aspect of "oh my goodness why aren't you hashing your passwords". How much ripping would HN impose on one of these institutions if they attempted a 100% best practices secure password upgrade and then subsequently had a complete IT disaster unfold (I can certainly link articles). For many banks and other financial institutions, going down for even 1 hour is a complete catastrophe. If people can't get their money out right away, they are leaving for the competition and you will likely get dinged by regulators. Bad people will continue to do bad things until the end of time. Killing your business to handle every edge case, even if it seems obvious, is not a good path to go down.
I would also consider this: These banks' IT systems are storing things that many of us would argue are much more valuable than your passwords. A bank's core system also represents the actual monetary value of every customer's account. We are talking about password security in a system domain where there are arguably far more valuable assets to secure. These assets are already implicitly protected by a massive apparatus extending as far as Ohio Class nuclear submarines patrolling the Pacific ocean.
Earlier quoted context omitted.
> Your security as a bank customer hinges on more than just one password, it's also about monitoring patterns of behavior, being aware of what's coming and going from your account, and protection mechanisms like the bank's insurance. Some banks do this better than others from past experience. For example, I definitely have Bank of America notify me when I do something out of the ordinary. I had gone to a gas station…
> I definitely have Bank of America notify me when I do something out of the ordinary. -And such routines are incredibly efficient; while commissioning one of our deliveries (heavy engineering equipment) in Namibia a few years ago, I found that the local power electronics distributor hadn't heard of my employer, and were (reasonably so) reluctant to hand over parts for $13,000 or so and send an invoice to Norway. VIS…
We have all these stories of how our feudal lords have been nice and helpful
But why not get the notifications yourself on your own devices?
You can set up your own policies for approving transactions or whatever. I understand that the chargebacks can be done up to 60 days, which means “seller beware” in the current financial system as opposed to “buyer beware” in the crypto one. But in the crypto one, you are in charge of your keys. And the arguments made in favor of banks could have just as easily been made for printing presses or telephone switchboard operators!