Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

291–300 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#291

Post by dx034 »

huebomont wrote: post #257
baud147258 wrote: post #207

Earlier quoted context omitted.

You can use letters in your password? Luxury! I only get 0-9. Not an American bank though (BNP Paribas in France).

BNP's password interface is insane. Instead of having normal password options, they limit it to 0-9 and then implement some hideous and overcomplicated front-end that randomizes the positions of each number on a virtual keypad and you click to enter your password.

Sucks for users but means you can't use key loggers or click loggers to get users' pins. From a security perspective it's actually pretty good. Even if they offered more complex passwords most people would choose a simple one anyway. This likely reduces fraud for the most vulnerable. It obviously sucks for people who know how to protect their devices.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#292

Post by speedplane »

The law is not behind or antiquated in this case. Bank cybersecurity has been regulated for quite some time now, and failing to adequately secure your digital assets is a compliance violation no different than failing to catch obvious fraud.

It's very likely that your bank is based and regulated by New York State, even if it isn't physically based there. Contact the NY State attorney general's office, they should take you seriously.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#294

Post by imtringued »

It is possible that this is intended and that they will prompt you to enter a new password on login.

Ask yourself these questions:

Are you sure it was your password? Did they generate a password for you? Did they verify that you are the account owner by asking you to enter the "hotline-pin"?

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#295

Post by imtringued »

akatechis wrote: post #187
bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

> These banks' IT systems are storing things that many of us would argue are much more valuable than your passwords. A bank's core system also represents the actual monetary value of every customer's account. We are talking about password security in a system domain where there are arguably far more valuable assets to secure. The password is what secures the more valuable things inside the account (the money). In fac…

>The password is what secures the more valuable things inside the account (the money). In fact, in nearly every case a password is used, no one really cares much about the password itself, but what's inside. That's why services require password in the first place.

Only access to the account is protected by the password. Sending money isn't protected by a password. It is protected with a second factor on top of requiring access to the account.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#296

Post by imtringued »

altacc wrote: post #285
kevin_thibedeau wrote: post #141

Earlier quoted context omitted.

So they can add columns for 2FA but strengthened password storage is not doable? This was forgivable 30 years ago. It was bad practice 20 years ago. Someone could have demonstrated leadership and developed a ten year plan to fix their legacy problem then.

> This was forgivable 30 years ago. A lot of the mainframe systems running large organisations were written more than 30 years ago and are still the core of the business, so their limitations are the constraints everyone else works around. > Someone could have demonstrated leadership and developed a ten year plan to fix their legacy problem then. The large project I work on is 12 years into replacing the mainframe pl…

We have a legacy database at our company that we simply wrapped with a service. There are still a lot of clients that access the database directly but that number is shrinking. Limitations of the database can be worked around in the service layer so it wouldn't matter to us if we still use the original database in 10 years but it also wouldn't matter if we just migrate it to postgres one day.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#297

Post by imtringued »

moviuro wrote: post #258
jdc wrote: post #252

Earlier quoted context omitted.

[...] clearly money was better spent on a more modern offer than on those "security" concerns. And there's the real problem: The banks will save their money and stick with plaintext if they can get away it . Put another way, it's an incentive problem.

Have you seen how French banks authenticate users? With a six-digit PIN. See - https://www.labanquepostale.fr/ > "Me Connecter" - https://lcl.fr/ > "Mon Espace" - https://particuliers.societegenerale.fr/com/icd-web/cbo/inde... > 12345678 > Valider

Speaking about Germany here, the online banking userid is much longer and basically acts a second password. It's not written on your card or used for anything except logging into your account via online banking.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#298

Post by TecoAndJix »

godelski wrote: post #256
micheljansen wrote: post #235

Really shocked at all the handwavy comments. > “It’s fine, there are more checks in place to prevent unauthorised transactions” > “Also, it’s insured” Well ok, that means the bank is protected, but what about my (sensitive) data such as transaction history? > “If anyone does anything bad, law enforcement will step in” Yeah, I totally trust a bank that can’t even properly deal with something as basic as passwords to n…

>> “If anyone does anything bad, law enforcement will step in” >Yeah, I totally trust a bank that can’t even properly deal with something as basic as passwords to notice breaches reliably. As an example of this: Equifax. This happened in 2017, and not really much has happened and people haven't been prosecuted. So everyone got some identity theft protection for a year. That didn't solve the problem. Equifax lost a li…

Link to the symbolic indictment - https://www.justice.gov/opa/pr/chinese-military-personnel-ch...

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#299

Post by imtringued »

IncRnd wrote: post #232
carterehsmith wrote: post #212

Earlier quoted context omitted.

Yeah, this "we can't extend password beyond 8 characters because legacy systems" argument does not hold water. My experience: built a Web site/app for: a) major bank b) major corp, back in the days when Web presence was kind of a new thing. ~15-20 years ago. You build a new (Web) app and treat the legacy system (happened to be some mainframe) as a backend or whatever. Add new tables to hold user's credentials, email…

>> Add new tables to hold user's credentials, email addresses, and whatever else. Adding a table to hold users' credentials doesn't really solve the problem that is being discussed, which is storing users' credentials. All that does is add a new attack surface, stealing the new credentials, and the original credentials are still in the same position.

Yes, you are right but we are talking about potential causes of these strange policy decisions. One source is simply old software that cannot be updated but this sub-thread is trying to debunk that by saying that you can have a modern table with hashed passwords and a generated secret value that conforms legacy restrictions. The secret value can be used as a password on the old mainframe. There will be collisions but they can be prevented by comparing usernames.

There is no technical excuse for not hashing passwords.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#300

Post by tibbydudeza »

My bank uses 2FA or biometric via their android app to approve all payments and adding of new beneficiaries on their online banking platform.

But it is a pain when I switch phones and need to get the old one deactivated and the new one authorized.

Post reply on HN