Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

241–250 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#241

Post by micheljansen »

Recursing wrote: post #134
PeterisP wrote: post #98

Earlier quoted context omitted.

GDPR does not have any wording that refers to any technical specifics (e.g. password storage) whatsoever. The most relevant passage is "the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk" from article 32; and it could be argued that having passwords in plaintext most likely does not constitute "appropriate technical…

Yes of course GDPR is not a law about plain text passwords, but (as the sibling comment points out), pretty much everybody considers the use of appropriate hashing as a requirement to to ensure a level of security appropriate to the risk. https://www.gamingtechlaw.com/2019/04/first-gdpr-fine-italy.... this fine specifically mentions password storage (among many other things) Also see previous thread on HN: https://ne…

On top of that GDPR requires companies to notify customers of data breaches, which risks reputation damage. Another liability of shoddy security.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#242

Post by schoen »

ghostpepper wrote: post #237
dontbenebby wrote: post #223

Earlier quoted context omitted.

This very looks cool, thank you for sharing parent. I apologize for the nitpick, but I hope there will be some guidance on what an "anonymous" email is. (Ex: Guerilla at a public wifi like a library, an email created at a library, but not your usual email from a place other than your home) I worry sometimes that we assume people reporting security vulnerabilities will be security experts. I often meet people who are…

> I often meet people who are intelligent and technical, but either do not understand security, or understand it in terms of confidentiality, integrity, and availability (CIA triad) and flounder when thinking about anonymity. Can you suggest any resources for a technical user who would like to learn more about this distinction?

You might like some of the papers at

https://www.freehaven.net/anonbib/

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#243

Post by jaquers »

tantalor wrote: post #151
bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

> For many banks and other financial institutions, going down for even 1 hour is a complete catastrophe. Are you joking? It's a common trope for bank websites to go down for "scheduled maintenance". Not to mention real-world bank branches keep bizarre hours and close for random holidays like Presidents' Day and Veterans' Day. Why do banks and credit card companies need to perform "scheduled maintenance" during which…

random holidays > federal holidays

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#244

Post by nolok »

loufe wrote: post #185

My bank just changed from a 6-number password (literally no option for more or less characters nor anything but digits) to rational passwords this month. I don't know how my WoW account 10 years ago needed an authenticator but the people managing my retirement savings didn't light a fire under asses to get that done. Legislation should have and likely still should be put in place.

Your wow account security was done with post-2000 tech, your life saving account security still depends on 1970s mainframe rules.

I agree about the legislation part.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#246

Post by tgsovlerkhgsel »

PeterisP wrote: post #98
Recursing wrote: post #84

Earlier quoted context omitted.

> Is there a law against clear text passwords In Europe GDPR covers that, many big websites started hashing after it Edit: could somebody explain the downvotes? The comments seem to agree with me Obviously GDPR is not a law about plain text passwords, but as the comments say it forces "the use of an appropriate hashing algorithm to store your passwords, protecting the means by which users enter their passwords, defen…

GDPR does not have any wording that refers to any technical specifics (e.g. password storage) whatsoever. The most relevant passage is "the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk" from article 32; and it could be argued that having passwords in plaintext most likely does not constitute "appropriate technical…

GDPR doesn't state explicitly "passwords must be hashed", but Knuddels.de was fined for unhashed passwords. The fine was specifically for the lack of hashing and not the breach that uncovered it.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#247

Post by carapace »

empath75 wrote: post #224
carapace wrote: post #215

Earlier quoted context omitted.

> As someone who works in finance/banking, I can assure you that this is not uncommon. And so, each time, you've reported them to this US-CERT thing the (current) top comment mentions so that proper steps can be taken, riiiiight? If you know about this and do nothing that's also part of the problem.

Did you know you can transfer money out of an account with nothing more than the checking account number that’s printed on all your checks along with your name and home address?

Which leaves a "paper" trail that doesn't point to your own compromised account, eh?

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#248

Post by wry_discontent »

dontbenebby wrote: post #223
alltakendamned wrote: post #39

It seems you're not getting serious answers here, so here's my take. Please report this via the US-CERT at https://www.us-cert.gov/report This will allow you to report it, eventually from an anonymous email address, without exposing you directly to the bank which might react bad to you. CERT can handle the coordination with the bank, this is what they do.

This very looks cool, thank you for sharing parent. I apologize for the nitpick, but I hope there will be some guidance on what an "anonymous" email is. (Ex: Guerilla at a public wifi like a library, an email created at a library, but not your usual email from a place other than your home) I worry sometimes that we assume people reporting security vulnerabilities will be security experts. I often meet people who are…

Out of curiosity, what's the point of the anonymous email? Why not just use my regular email?

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#249

Post by speculator »

alltakendamned wrote: post #39

It seems you're not getting serious answers here, so here's my take. Please report this via the US-CERT at https://www.us-cert.gov/report This will allow you to report it, eventually from an anonymous email address, without exposing you directly to the bank which might react bad to you. CERT can handle the coordination with the bank, this is what they do.

Really good suggestion. And in case they still need encouragement, some negative press coverage might get them going. Right person for this -> https://krebsonsecurity.com/

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#250

Post by jakub_g »

speculator wrote: post #249
alltakendamned wrote: post #39

It seems you're not getting serious answers here, so here's my take. Please report this via the US-CERT at https://www.us-cert.gov/report This will allow you to report it, eventually from an anonymous email address, without exposing you directly to the bank which might react bad to you. CERT can handle the coordination with the bank, this is what they do.

Really good suggestion. And in case they still need encouragement, some negative press coverage might get them going. Right person for this -> https://krebsonsecurity.com/

Came here to write that. Either Krebs or https://www.troyhunt.com
Post reply on HN