261–270 of 328 posts
Earlier quoted context omitted.
> although honestly putting it at 3-6AM mitigates a lot of my concerns with that. As long as the website is only used in a single timezone, I guess it's not too bad.
Buuuut the website is used across 4.5 hours of timezones: from the west coasts GMT-8 to the east coasts GMT-3:30
Earlier quoted context omitted.
Just checked to re-confirm: Wells Fargo passwords are case insensitive as well. This doesn't confirm that they store passwords in plaintext, as you said they may just convert to uppercase before hashing, but it is bad practice either way. There is a lot more possible entropy if QwErTy and QWERTY are distinct. However, there seems to be issues in the entire financial sector with inability to upgrade certain systems du…
My gut reaction to your story would be to assume that your local credit union is doing a better job than the big banks, not that there's a good explanation for the big banks. Credit unions frequently also offer better mortgage APRs, better savings APYs, better customer service, lower (or no) ATM fees, etc.
Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.
You can use letters in your password? Luxury! I only get 0-9. Not an American bank though (BNP Paribas in France).
Earlier quoted context omitted.
Strains credulity? What do you mean by that?
It is so unlikely that they would throw away half of the key space if they were really committed to doing things the right way (hashing/salting). It is more likely that they are storing everything in upper case plain text or in a DBMS that ignores case.
As a pure hypothetical situation, if the old system was terrible and, say, stored things in plaintext and did case-insensitive password lookups, then the new system needs to emulate that if they don't want to piss off existing customers by making their old password suddenly not work. The security side is going say "just have customers make new passwords", the business side will say "we won't budge, this has to be seamless", and the developers will settle with the crappy middleground of uppercasing everything before hashing to emulate the old system. Maybe they even maintain naive hope of improving the system down the road and convincing the next set of execs that its ok to revoke everyones password to allow them to better the system.
Don't get me wrong, plaintext stored in a DB is bad enough, if the DB gets compromised, but apparently they don't even need that as they have an interface that customer service can use to view your password.
How secure do you think that system is?
Earlier quoted context omitted.
Really good suggestion. And in case they still need encouragement, some negative press coverage might get them going. Right person for this -> https://krebsonsecurity.com/
Came here to write that. Either Krebs or https://www.troyhunt.com
Earlier quoted context omitted.
> Ultimately, it's not some malicious intent or incompetence, but simply the acknowledgement that the legacy systems will not enjoy PBKDF hash+salt+iterations columns being added 30 years after the fact. Are banks running their web interface on 30+ year old legacy systems? I'd expect the web stuff to be on much more modern systems, which call upon the 30+ year old stuff to do the underlying financial stuff.
Honestly 30 sounds young. Cobol is alive and well in these companies
So instead, it seems like the stuff holding just account holder information was given a password field to use on their fancy new HTML 2.0 webpage, but then just mostly left there ever since. The age of the financial side is fairly irrelevant in this scenario.
Earlier quoted context omitted.
This very looks cool, thank you for sharing parent. I apologize for the nitpick, but I hope there will be some guidance on what an "anonymous" email is. (Ex: Guerilla at a public wifi like a library, an email created at a library, but not your usual email from a place other than your home) I worry sometimes that we assume people reporting security vulnerabilities will be security experts. I often meet people who are…
Out of curiosity, what's the point of the anonymous email? Why not just use my regular email?
Earlier quoted context omitted.
You can use letters in your password? Luxury! I only get 0-9. Not an American bank though (BNP Paribas in France).
Is that password the only authentication they use?
And to change your phone number, you've to use a on-use password, sent by postal mail to your address.
Earlier quoted context omitted.
You can use letters in your password? Luxury! I only get 0-9. Not an American bank though (BNP Paribas in France).
Is that password the only authentication they use?