Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

171–180 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#171

Post by moviuro »

kevin_thibedeau wrote: post #141
bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

So they can add columns for 2FA but strengthened password storage is not doable? This was forgivable 30 years ago. It was bad practice 20 years ago. Someone could have demonstrated leadership and developed a ten year plan to fix their legacy problem then.

> developed a ten year plan to fix their legacy problem then

They did. And Pi factor came in. And budget was cut because those pesky fintech are a threat, and clearly money was better spent on a more modern offer than on those "security" concerns.

And yes, it's possible to add 2FA to the front layer. However, the remnants of COBOL code running on the mainframe for the last 25 years weren't designed to handle passwords length 9 or more, and the last guy who knew how that code was built has retired some 15 years ago.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#173

Post by smush »

slumdev wrote: post #117

Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.

TransUnion does plaintext passwords.

Found that out when I typed in a (example) 25 character password, but at some point the field was truncated down and I somehow figured out that if I backspace IIRC 4 characters away, my saved password worked.

-_-

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#174

Post by Spooky23 »

tentboy wrote: post #96

Since it seems this is PNC, I am one of those who now needs to find a new bank. Any recommendations? I used PNC for my checking/credit but already use an american express high yield savings. I was thinking maybe Capital One?

Why? The compliance requirements don't require hashing (iirc, "commercially reasonable" protection is/was the standard), so you should assume that any other bank is doing the same thing, as they probably are.

All that is needed to steal your money is the bank account number, which you probably have mailed out or otherwise provided to numerous random third parties, who process them with other third parties. There's almost no information in there that isn't already available to anyone who cares to look.

A more reasonable approach that actually impacts your security would be:

- Opt-out of electronic communication and get paper statements and account notifications. (This ensures that you receive notice, in the mail, about changes of address and other changes)

- Opt-in to notifications about large transfers or low balances.

- Disable Bill Pay features at the bank.

- Disable external ACH transfers.

- Request wire transfer privileges, which with some banks allows you to get a physical token to secure access to your account.

- Use a dedicated PC/iPad/Chromebook/etc for your banking to reduce the risk of malware capturing your banking details.

If you're going to switch banks over this, look for a credit union small enough that they use an off the shelf banking solution, and figure out what the default configuration of the solution is.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#175

Post by Guest0918231 »

tantalor wrote: post #151
bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

> For many banks and other financial institutions, going down for even 1 hour is a complete catastrophe. Are you joking? It's a common trope for bank websites to go down for "scheduled maintenance". Not to mention real-world bank branches keep bizarre hours and close for random holidays like Presidents' Day and Veterans' Day. Why do banks and credit card companies need to perform "scheduled maintenance" during which…

The Canadian Revenue Agency website is down from 3am to 6am every single day for maintenance. They are also scheduled to be down for days at a time.

https://www.canada.ca/en/revenue-agency/services/e-services/...

This site is used for everything. Reviewing your taxes, reading mail and notifications you've received from the government, filing returns, making payments, etc.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#176

Post by jedberg »

slumdev wrote: post #117

Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.

It's because the old mainframes they used to use only accepted uppercase passwords. A lot of of financial applications were uppercase only. I know this because my dad would often message me in all caps and then say, "sorry I was working in FinAppX and had caps lock on".

When the banks first moved to going online, they were just building thin interfaces on top of their mainframes. Hence things like password being letters and numbers only and max 8 characters. Some banks made this explicit, some just did upper() and truncate(8).

And at this point some have converted to modern technology but their tech debt lives on.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#177

Post by jedberg »

smush wrote: post #173
slumdev wrote: post #117

Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.

TransUnion does plaintext passwords. Found that out when I typed in a (example) 25 character password, but at some point the field was truncated down and I somehow figured out that if I backspace IIRC 4 characters away, my saved password worked. -_-

That doesn't necessarily mean they store in plaintext. They might just only hash the first 20 characters.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#178

Post by GauntletWizard »

smush wrote: post #173
slumdev wrote: post #117

Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.

TransUnion does plaintext passwords. Found that out when I typed in a (example) 25 character password, but at some point the field was truncated down and I somehow figured out that if I backspace IIRC 4 characters away, my saved password worked. -_-

This chain of logic does not follow. It is possible that your bank is properly salt+hashing your password - the truncation may have been on the back end before, and is now exposed to you because the field is shorter.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#180

Post by jcims »

slumdev wrote: post #137
jcims wrote: post #128

Earlier quoted context omitted.

Lol it's been that way for at least 20 years. Same with chase (well at least the bank one half of it). It seems remarkably stupid, but it's way cheaper for them to refund any losses and/or pay for lifetime credit monitoring than it is to deal with customer service calls from people getting locked out because they can't figure out how to deal with uppercase and lowercase letters.

I get that Amex would do this. It seems to be their attitude. They seem absolutely bent on eating the cost of fraud to make life easier for their customer. For the other banks, the motivation is harder to understand.

Same motivation. Call center costs related to account recovery are astronomical when you have tens of millions of customers. The authentication systems at large banks are generally a bit more 'observational' than just watching what password is sent (not always of course) so you can still mitigate many threats while still allowing for reduced login friction.
Post reply on HN