name and shame.
Ask HN: A major USA bank is storing passwords in cleartext – what to do?
231–240 of 328 posts
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#232Earlier quoted context omitted.
So they can add columns for 2FA but strengthened password storage is not doable? This was forgivable 30 years ago. It was bad practice 20 years ago. Someone could have demonstrated leadership and developed a ten year plan to fix their legacy problem then.
Yeah, this "we can't extend password beyond 8 characters because legacy systems" argument does not hold water. My experience: built a Web site/app for: a) major bank b) major corp, back in the days when Web presence was kind of a new thing. ~15-20 years ago. You build a new (Web) app and treat the legacy system (happened to be some mainframe) as a backend or whatever. Add new tables to hold user's credentials, email…
>> Add new tables to hold user's credentials, email addresses, and whatever else.
Adding a table to hold users' credentials doesn't really solve the problem that is being discussed, which is storing users' credentials. All that does is add a new attack surface, stealing the new credentials, and the original credentials are still in the same position.
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#233Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.
It's because the old mainframes they used to use only accepted uppercase passwords. A lot of of financial applications were uppercase only. I know this because my dad would often message me in all caps and then say, "sorry I was working in FinAppX and had caps lock on". When the banks first moved to going online, they were just building thin interfaces on top of their mainframes. Hence things like password being lett…
I yell often in my teams/skype messages to people because I'll switch from the mainframe to the modern world. Kinda humorous.
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#234As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…
> These banks' IT systems are storing things that many of us would argue are much more valuable than your passwords. A bank's core system also represents the actual monetary value of every customer's account. We are talking about password security in a system domain where there are arguably far more valuable assets to secure. The password is what secures the more valuable things inside the account (the money). In fac…
> The password is what secures the more valuable things inside the account (the money)
> I think the bigger consideration is actually how to exfiltrate money from an account that you compromise: If you initiate a wire transfer to some account you control, that leaves a paper trail, and typically has a lag time, during which the institution/customer have a chance to react.
It sounds like your third paragraph contradicts your first - it's not just your password that protects the money, but the institution whose business it is to maintain and reconcile paper trails.
Banks were using signatures(!) to protect depositors' money long before passwords existed - and they have had processes to mitigate fraud since then. While not ideal, plain text passwords are huge upgrade over signatures
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#235Really shocked at all the handwavy comments.
> “It’s fine, there are more checks in place to prevent unauthorised transactions”
> “Also, it’s insured”
Well ok, that means the bank is protected, but what about my (sensitive) data such as transaction history?
> “If anyone does anything bad, law enforcement will step in”
Yeah, I totally trust a bank that can’t even properly deal with something as basic as passwords to notice breaches reliably.
> “It would be too expensive to replace legacy systems”
And that’s the consumer’s problem?
I really hope none of you apologists are moving fast and breaking things at any company that is entrusted with people’s personal information or is needed for more critical infrastructure of everyday life than cat pics and funny polls.
In Europe banks also don’t like paying to replace legacy systems to maintain security, but such a failure to protect consumer data and privacy would be in serious breach of legislation and result in significant fines.
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#236Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.
Just checked to re-confirm: Wells Fargo passwords are case insensitive as well. This doesn't confirm that they store passwords in plaintext, as you said they may just convert to uppercase before hashing, but it is bad practice either way. There is a lot more possible entropy if QwErTy and QWERTY are distinct. However, there seems to be issues in the entire financial sector with inability to upgrade certain systems du…
> This doesn't confirm that they store passwords in plaintext
They definitely store pincodes.
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#237It seems you're not getting serious answers here, so here's my take. Please report this via the US-CERT at https://www.us-cert.gov/report This will allow you to report it, eventually from an anonymous email address, without exposing you directly to the bank which might react bad to you. CERT can handle the coordination with the bank, this is what they do.
This very looks cool, thank you for sharing parent. I apologize for the nitpick, but I hope there will be some guidance on what an "anonymous" email is. (Ex: Guerilla at a public wifi like a library, an email created at a library, but not your usual email from a place other than your home) I worry sometimes that we assume people reporting security vulnerabilities will be security experts. I often meet people who are…
> I often meet people who are intelligent and technical, but either do not understand security, or understand it in terms of confidentiality, integrity, and availability (CIA triad) and flounder when thinking about anonymity.
Can you suggest any resources for a technical user who would like to learn more about this distinction?
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#238As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…
Maybe they cannot change the database schema, but surely they can change the UI so the password is not shown to the call-center staff.
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#239It seems you're not getting serious answers here, so here's my take. Please report this via the US-CERT at https://www.us-cert.gov/report This will allow you to report it, eventually from an anonymous email address, without exposing you directly to the bank which might react bad to you. CERT can handle the coordination with the bank, this is what they do.
This very looks cool, thank you for sharing parent. I apologize for the nitpick, but I hope there will be some guidance on what an "anonymous" email is. (Ex: Guerilla at a public wifi like a library, an email created at a library, but not your usual email from a place other than your home) I worry sometimes that we assume people reporting security vulnerabilities will be security experts. I often meet people who are…
An easier way may be to anonymously message a tech savvy media company or security firm, maybe via snail mail even. You can do it anonymously yourself but it'll take some work and a mashup of:
- VPN service where you pay with cash (Mullvad) - Temporary email (Protonmail?) - One time use computer (cybercafe, pay with cash?)
There's layers you can apply like a TOR browser usage but it'll take more effort/learning.
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#240As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…
> As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with Are there any standards that doing this violates, and if so do banks have a person in the org (or external to the org) that violations of said standard can report to? > We are talking about password security in a system domain where there are arguably far more valuable asset…
Look at it this way - banks will continue to support check payments for the foreseeable future, and checks violate every single security best practice by today's standards. The infrastructure to support checks without fraud burning everything to the ground was built up over centuries and works fairly well, this infrastructure works and has been extended to deter electronic fraud - so why waste time on technological navel gazing?