Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

191–200 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#191

Post by smush »

GauntletWizard wrote: post #178
smush wrote: post #173

Earlier quoted context omitted.

TransUnion does plaintext passwords. Found that out when I typed in a (example) 25 character password, but at some point the field was truncated down and I somehow figured out that if I backspace IIRC 4 characters away, my saved password worked. -_-

This chain of logic does not follow. It is possible that your bank is properly salt+hashing your password - the truncation may have been on the back end before, and is now exposed to you because the field is shorter.

Maybe - but why not indicate clear password length requirements on the password entry screen and/or have the PWE text input HTML form only accept password characters up to that max length?

Additionally, silent trucation and 'maybe we do salt and hash after all' makes no sense IMO. That's not to say that I disagree that this is a possibility, only that the whole point of a hash is that it converts something of arbitrary length to a single length.

Therefore, truncating data that gets inputted into the hash would be computationally wasteful for no benefit, because the hash function will always result in a single length.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#192

Post by notyourday »

pc86 wrote: post #78
notyourday wrote: post #8

Earlier quoted context omitted.

> You should report to proper authorities about the severity of the issue. Reach out to their security or technical higher up department of the bank. Switch your bank. Do not reach out to the bank's security/technical! There's a non-zero chance that the response from the bank would be to reach out to the FBI and claim that you are the "hacker". It will create an enormous headache for you. If you are going to reach ou…

Does storing passwords using two-way encryption violate some OCC regulation?

It is about what you are optimizing for. You, a customer, notifying a bank would probably do nothing. You, a bank customer, filing a formal complaint with a banking regulator triggers procedures to handle it that a regulator has which in turn triggers handling procedures that a bank has. You do not complain that the bank stores passwords in cleartext. Instead you complain that the bank does not adequately safeguard information needed to access your account from the third parties with the example being the customer service agent being able to see not only your ID ( which they can and need to do their job ) but also your password ( which they do not need to access ). So not only the customer service agent can access your account while on-duty in the call center via a special system but also can either themselves or via another party access the bank account as if it were you.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#193

Post by loeg »

chris_overseas wrote: post #101
the_french wrote: post #89

Earlier quoted context omitted.

Even worse, a major French bank removed their perfectly fine password requirements and replaced it with a 6 digit PIN that you have to enter via an on-screen numpad. They explicitly block password managers from autofilling too! And I had just managed to get my parents to start using one.

Well Westpac had an onscreen keyboard for the password entry too until about 18 months ago. When they finally replaced it with a (thankfully password-safe friendly) text box they had this to say: "At Westpac, we are continually striving to provide the highest quality service and security to help support our Online Banking customers. From the end of May 2018, we will be removing the keypad from the online sign-in scre…

The US treasury does/did this on-screen keyboard thing as well (at least up until I stopped needing to login to that website within the last year or two). The "best" method I had around it was to copy the password out of my manager, use developer tools to find the '' element, and add 'value="[paste]"' manually.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#194

Post by cataflam »

slumdev wrote: post #117

Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.

Blizzard battle.net used to do that, and probably still does: transform to lower or upper case (then hash because I'm giving them the benefit of the doubt), instead of dealing with customer support at a large scale of people messing up capitalisation of their passwords.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#195

Post by loeg »

daveoc64 wrote: post #100
Wheaties466 wrote: post #76

Earlier quoted context omitted.

Alternatively I feel like Troy Hunt may also be able to help https://twitter.com/troyhunt He runs the @haveibeenpwned service

Troy has actually covered a similar topic to this in the past: https://www.troyhunt.com/banks-arbitrary-password-restrictio... His viewpoint seems to be that poor security practices around passwords in banks are not a big deal, due to the overall processes that banks use to prevent fraud.

I would tend to agree, for now, except that banks are doing their best to shunt responsibility for fraud onto merchants and customers. There are obvious financial incentives that will encourage them to continue trying to do so.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#197

Post by OldFatCactus »

rs23296008n1 wrote: post #3

Move your money to a different bank. Now that banks aren't paying useful interest rates they are mostly only tolerable for security and convenient access to your money. If they can't do those two then... what exactly are they for? Likely nothing.

are any banks paying useful interest rates?

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#198

Post by topkai22 »

Does anyone know if PCI rules call for non reversible storage of passwords (hashing)?

I looked quickly online but the only reference I could find was that "passwords are protected by strong cryptography in transit and at rest", which seems to allow wiggle room to store passwords in reversible but encrypted format.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#200

Post by tentboy »

Spooky23 wrote: post #174
tentboy wrote: post #96

Since it seems this is PNC, I am one of those who now needs to find a new bank. Any recommendations? I used PNC for my checking/credit but already use an american express high yield savings. I was thinking maybe Capital One?

Why? The compliance requirements don't require hashing (iirc, "commercially reasonable" protection is/was the standard), so you should assume that any other bank is doing the same thing, as they probably are. All that is needed to steal your money is the bank account number, which you probably have mailed out or otherwise provided to numerous random third parties, who process them with other third parties. There's al…

Thanks for recommendations. I will admit I overreacted when I saw the headline and found out it was PNC. Just not the thing I expected to start my day hearing.

I already use 2FA, a unique password only with PNC and alerts on all account activity, including logins.

I will look into some of the things you listed!

Post reply on HN