Ask HN: A major USA bank is storing passwords in cleartext – what to do?

Post by rimliu » Tue, Feb 18, 2020, 10:52 PM UTC

vegardx wrote: post #221

It never ceases to amaze me what the state of online banking is around the world. Here we have something called BankID which comes in two flavors, one that is a physical token that generates TOPT used to log in, either in a combination with a password or a PIN on the token device itself, referred to as BankID. And the other, much slicker solution, called BankID on Mobile, which runs as SIM-application on your phone w…

Post by notyourday » Tue, Feb 18, 2020, 11:10 PM UTC

carapace wrote: post #216

notyourday wrote: post #8

Earlier quoted context omitted.

> You should report to proper authorities about the severity of the issue. Reach out to their security or technical higher up department of the bank. Switch your bank. Do not reach out to the bank's security/technical! There's a non-zero chance that the response from the bank would be to reach out to the FBI and claim that you are the "hacker". It will create an enormous headache for you. If you are going to reach ou…

https://www.occ.treas.gov/ ?

Post by exikyut » Wed, Feb 19, 2020, 12:46 AM UTC

otachack wrote: post #239

dontbenebby wrote: post #223

Earlier quoted context omitted.

This very looks cool, thank you for sharing parent. I apologize for the nitpick, but I hope there will be some guidance on what an "anonymous" email is. (Ex: Guerilla at a public wifi like a library, an email created at a library, but not your usual email from a place other than your home) I worry sometimes that we assume people reporting security vulnerabilities will be security experts. I often meet people who are…

An easier way may be to anonymously message a tech savvy media company or security firm, maybe via snail mail even. You can do it anonymously yourself but it'll take some work and a mashup of: - VPN service where you pay with cash (Mullvad) - Temporary email (Protonmail?) - One time use computer (cybercafe, pay with cash?) There's layers you can apply like a TOR browser usage but it'll take more effort/learning.

Post by [deleted] » Wed, Feb 19, 2020, 2:04 AM UTC

tantalor wrote: post #151

bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

> For many banks and other financial institutions, going down for even 1 hour is a complete catastrophe. Are you joking? It's a common trope for bank websites to go down for "scheduled maintenance". Not to mention real-world bank branches keep bizarre hours and close for random holidays like Presidents' Day and Veterans' Day. Why do banks and credit card companies need to perform "scheduled maintenance" during which…

Post by cjbprime » Wed, Feb 19, 2020, 2:40 AM UTC

micheljansen wrote: post #235

Really shocked at all the handwavy comments. > “It’s fine, there are more checks in place to prevent unauthorised transactions” > “Also, it’s insured” Well ok, that means the bank is protected, but what about my (sensitive) data such as transaction history? > “If anyone does anything bad, law enforcement will step in” Yeah, I totally trust a bank that can’t even properly deal with something as basic as passwords to n…