Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

251–260 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#251

Post by aledalgrande »

otachack wrote: post #239
dontbenebby wrote: post #223

Earlier quoted context omitted.

This very looks cool, thank you for sharing parent. I apologize for the nitpick, but I hope there will be some guidance on what an "anonymous" email is. (Ex: Guerilla at a public wifi like a library, an email created at a library, but not your usual email from a place other than your home) I worry sometimes that we assume people reporting security vulnerabilities will be security experts. I often meet people who are…

An easier way may be to anonymously message a tech savvy media company or security firm, maybe via snail mail even. You can do it anonymously yourself but it'll take some work and a mashup of: - VPN service where you pay with cash (Mullvad) - Temporary email (Protonmail?) - One time use computer (cybercafe, pay with cash?) There's layers you can apply like a TOR browser usage but it'll take more effort/learning.

Or you could email Troy Hunt

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#252

Post by jdc »

moviuro wrote: post #171
kevin_thibedeau wrote: post #141

Earlier quoted context omitted.

So they can add columns for 2FA but strengthened password storage is not doable? This was forgivable 30 years ago. It was bad practice 20 years ago. Someone could have demonstrated leadership and developed a ten year plan to fix their legacy problem then.

> developed a ten year plan to fix their legacy problem then They did. And Pi factor came in. And budget was cut because those pesky fintech are a threat, and clearly money was better spent on a more modern offer than on those "security" concerns. And yes, it's possible to add 2FA to the front layer. However, the remnants of COBOL code running on the mainframe for the last 25 years weren't designed to handle password…

[...] clearly money was better spent on a more modern offer than on those "security" concerns.

And there's the real problem:

The banks will save their money and stick with plaintext if they can get away it.

Put another way, it's an incentive problem.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#254

Post by rodw »

micheljansen wrote: post #235

Really shocked at all the handwavy comments. > “It’s fine, there are more checks in place to prevent unauthorised transactions” > “Also, it’s insured” Well ok, that means the bank is protected, but what about my (sensitive) data such as transaction history? > “If anyone does anything bad, law enforcement will step in” Yeah, I totally trust a bank that can’t even properly deal with something as basic as passwords to n…

> such a failure to protect consumer data and privacy would be in serious breach of legislation

I imagine this is true in the US also (which may be why the OP asked about reporting this).

> result in significant fines

This part I have less confidence in. :(

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#255

Post by poopchute »

wtetzner wrote: post #225
yjftsjthsd-h wrote: post #210

Earlier quoted context omitted.

That sounds amazing ... as an admin, I mean. Can you imagine being allowed to have scheduled downtime every day ? It does suck a bit for users, although honestly putting it at 3-6AM mitigates a lot of my concerns with that.

> although honestly putting it at 3-6AM mitigates a lot of my concerns with that. As long as the website is only used in a single timezone, I guess it's not too bad.

Buuuut the website is used across 4.5 hours of timezones: from the west coasts GMT-8 to the east coasts GMT-3:30

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#256

Post by godelski »

micheljansen wrote: post #235

Really shocked at all the handwavy comments. > “It’s fine, there are more checks in place to prevent unauthorised transactions” > “Also, it’s insured” Well ok, that means the bank is protected, but what about my (sensitive) data such as transaction history? > “If anyone does anything bad, law enforcement will step in” Yeah, I totally trust a bank that can’t even properly deal with something as basic as passwords to n…

>> “If anyone does anything bad, law enforcement will step in”

>Yeah, I totally trust a bank that can’t even properly deal with something as basic as passwords to notice breaches reliably.

As an example of this: Equifax. This happened in 2017, and not really much has happened and people haven't been prosecuted. So everyone got some identity theft protection for a year. That didn't solve the problem. Equifax lost a little money. So little changes. And the claim is that it is Chinese state actors that did this, so no one will get prosecuted (because we just let China attack us?).

So handwavy seems defeatist.

Also, if this is a major bank, then Equifax is a great parallel to draw from.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#257

Post by huebomont »

baud147258 wrote: post #207
slumdev wrote: post #117

Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.

You can use letters in your password? Luxury! I only get 0-9. Not an American bank though (BNP Paribas in France).

BNP's password interface is insane. Instead of having normal password options, they limit it to 0-9 and then implement some hideous and overcomplicated front-end that randomizes the positions of each number on a virtual keypad and you click to enter your password.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#258

Post by moviuro »

jdc wrote: post #252
moviuro wrote: post #171

Earlier quoted context omitted.

> developed a ten year plan to fix their legacy problem then They did. And Pi factor came in. And budget was cut because those pesky fintech are a threat, and clearly money was better spent on a more modern offer than on those "security" concerns. And yes, it's possible to add 2FA to the front layer. However, the remnants of COBOL code running on the mainframe for the last 25 years weren't designed to handle password…

[...] clearly money was better spent on a more modern offer than on those "security" concerns. And there's the real problem: The banks will save their money and stick with plaintext if they can get away it . Put another way, it's an incentive problem.

Have you seen how French banks authenticate users?

With a six-digit PIN.

See

- https://www.labanquepostale.fr/ > "Me Connecter"

- https://lcl.fr/ > "Mon Espace"

- https://particuliers.societegenerale.fr/com/icd-web/cbo/inde... > 12345678 > Valider

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#259

Post by daveoc64 »

Recursing wrote: post #182
daveoc64 wrote: post #160

Earlier quoted context omitted.

Unfortunately, they are still non-committal on what is required. They advise that passwords should be hashed, but there is nothing that makes that a binding requirement. The gist is still "do what you think is appropriate". The ICO talks about balancing risks and convenience, and the banks will argue that their systems are secure overall, and don't make the consumer liable anyway. Under the ICO's guidance, an organis…

Are you sure? What about the fines they're already giving? https://news.ycombinator.com/item?id=18531588

That's in Germany. It's up to the regulator in each country to enforce the rules.

The ICO has a reputation for being toothless.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#260

Post by slumdev »

copperx wrote: post #162
slumdev wrote: post #117

Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.

Strains credulity? What do you mean by that?

It is so unlikely that they would throw away half of the key space if they were really committed to doing things the right way (hashing/salting).

It is more likely that they are storing everything in upper case plain text or in a DBMS that ignores case.

Post reply on HN