Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#211

Post by ConcernedCoder »

bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

"For some strange reason when a bank calls the FBI things move with a high level of expediency."

Except when these hackers are in China, etc...

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#212

Post by carterehsmith »

kevin_thibedeau wrote: post #141
bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

So they can add columns for 2FA but strengthened password storage is not doable? This was forgivable 30 years ago. It was bad practice 20 years ago. Someone could have demonstrated leadership and developed a ten year plan to fix their legacy problem then.

Yeah, this "we can't extend password beyond 8 characters because legacy systems" argument does not hold water.

My experience: built a Web site/app for: a) major bank b) major corp, back in the days when Web presence was kind of a new thing. ~15-20 years ago.

You build a new (Web) app and treat the legacy system (happened to be some mainframe) as a backend or whatever. Add new tables to hold user's credentials, email addresses, and whatever else. Link the "new" credentials with the old "account id on mainframe" or whatever. Not really rocket science.

BTW - there was no such thing as an "old password table with max 8 character", not for retail customers. Retail customer did not have a password, or email.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#213

Post by buckminster »

bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

None of this explains why the passwords are exposed to customer service reps.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#214

Post by overgard »

tzs wrote: post #157
bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

> Ultimately, it's not some malicious intent or incompetence, but simply the acknowledgement that the legacy systems will not enjoy PBKDF hash+salt+iterations columns being added 30 years after the fact. Are banks running their web interface on 30+ year old legacy systems? I'd expect the web stuff to be on much more modern systems, which call upon the 30+ year old stuff to do the underlying financial stuff.

Honestly 30 sounds young. Cobol is alive and well in these companies

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#215

Post by carapace »

bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

> As someone who works in finance/banking, I can assure you that this is not uncommon.

And so, each time, you've reported them to this US-CERT thing the (current) top comment mentions so that proper steps can be taken, riiiiight?

If you know about this and do nothing that's also part of the problem.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#216

Post by carapace »

notyourday wrote: post #8
rasikjain wrote: post #6

You should report to proper authorities about the severity of the issue. Reach out to their security or technical higher up department of the bank. In your case, they may or may not be storing the password in cleartext. They might be using the two way encryption instead of one-way hash. Passwords should be hashed (with salt) and it is irreversible. For a financial institution, revealing your password by a customer se…

> You should report to proper authorities about the severity of the issue. Reach out to their security or technical higher up department of the bank. Switch your bank. Do not reach out to the bank's security/technical! There's a non-zero chance that the response from the bank would be to reach out to the FBI and claim that you are the "hacker". It will create an enormous headache for you. If you are going to reach ou…

https://www.occ.treas.gov/ ?

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#217

Post by overgard »

I once did an API integration with a very popular well known brokerage. When we asked for a test account for their API... well they didn't have a test environment, so they just gave us a real account with 10k dollars in it with instructions to be careful. The test account was something like "apitest11" and the password was like "11apitest". Did that money mysteriously get stolen? Yup! (Not by me definitely, but that account must have been shared with 15 or so people, with a trivial password if it had been an outsider)

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#218

Post by [deleted] »

overgard wrote: post #217

I once did an API integration with a very popular well known brokerage. When we asked for a test account for their API... well they didn't have a test environment, so they just gave us a real account with 10k dollars in it with instructions to be careful. The test account was something like "apitest11" and the password was like "11apitest". Did that money mysteriously get stolen? Yup! (Not by me definitely, but that…

[deleted]

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#219

Post by PascLeRasc »

tentboy wrote: post #96

Since it seems this is PNC, I am one of those who now needs to find a new bank. Any recommendations? I used PNC for my checking/credit but already use an american express high yield savings. I was thinking maybe Capital One?

I moved from PNC to SoFi a few months ago and I'm very happy with them. ATM fees everywhere are automatically reimbursed and their customer service is fantastic.

Make sure if you have a Virtual Wallet account with PNC to manually downgrade it to the lowest tier, and keep $500 in it until you're ready to close the account. It'll charge you $7/month otherwise, more if you're at a higher interest tier currently.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#220

Post by HideousKojima »

slumdev wrote: post #117

Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.

Just checked and Chase is case-insensitive too. Meanwhile my local credit union is not.
Post reply on HN