Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

301–310 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#301

Post by manmademagic »

loeg wrote: post #193
chris_overseas wrote: post #101

Earlier quoted context omitted.

Well Westpac had an onscreen keyboard for the password entry too until about 18 months ago. When they finally replaced it with a (thankfully password-safe friendly) text box they had this to say: "At Westpac, we are continually striving to provide the highest quality service and security to help support our Online Banking customers. From the end of May 2018, we will be removing the keypad from the online sign-in scre…

The US treasury does/did this on-screen keyboard thing as well (at least up until I stopped needing to login to that website within the last year or two). The "best" method I had around it was to copy the password out of my manager, use developer tools to find the ' ' element, and add 'value="[paste]"' manually.

I used to bank with WestPac and from memory it wasn’t possible to do this as they had some additional javascript running that would cipher every letter.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#302

Post by manmademagic »

chris_overseas wrote: post #80

One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characters long(!) consisting only of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password: https://banking.westpac.com.au/ I complained to them about this…

ING Australia is even worse for this, as it’s an 8 digit acc number with a 4 digit PIN to login.

St. George isn’t as terrible, but they have a quirk of requiring a 4 digit security number along with your password. That’s not how MFA works...

Better security practices and open APIs are the two things I wish banks would get sorted.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#303

Post by mgamache »

resoluteteeth wrote: post #132
mgamache wrote: post #129

The password is probably encrypted using a two-way hash. It's not as secure as a one-way has, but you can't see passwords by running a SQL query.

What is a "two-way hash" and how is it different from normal encryption?

https://cs.stackexchange.com/questions/69422/two-way-hash-fu...

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#304

Post by mgamache »

_fizz_buzz_ wrote: post #133
mgamache wrote: post #129

The password is probably encrypted using a two-way hash. It's not as secure as a one-way has, but you can't see passwords by running a SQL query.

What's a two-way hash? Isn't it just a cipher at that point?

https://stackoverflow.com/questions/4948322/fundamental-diff...

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#305

Post by sneak »

speculator wrote: post #249
alltakendamned wrote: post #39

It seems you're not getting serious answers here, so here's my take. Please report this via the US-CERT at https://www.us-cert.gov/report This will allow you to report it, eventually from an anonymous email address, without exposing you directly to the bank which might react bad to you. CERT can handle the coordination with the bank, this is what they do.

Really good suggestion. And in case they still need encouragement, some negative press coverage might get them going. Right person for this -> https://krebsonsecurity.com/

I do not think that recommending Brian Krebs is a good idea for someone who might wish to avoid retaliation. Recently, he doxxed some people on Twitter for reporting bugs.

https://www.itwire.com/security/infosec-researchers-slam-ex-...

As a result, I no longer visit his site or recommend his work. Publishing someone else’s personal data without consent is a terrible thing, and is one of the reasons so many of us work to secure systems. His behavior undermines that.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#306

Post by guiambros »

sneak wrote: post #305
speculator wrote: post #249

Earlier quoted context omitted.

Really good suggestion. And in case they still need encouragement, some negative press coverage might get them going. Right person for this -> https://krebsonsecurity.com/

I do not think that recommending Brian Krebs is a good idea for someone who might wish to avoid retaliation. Recently, he doxxed some people on Twitter for reporting bugs. https://www.itwire.com/security/infosec-researchers-slam-ex-... As a result, I no longer visit his site or recommend his work. Publishing someone else’s personal data without consent is a terrible thing, and is one of the reasons so many of us work…

"Krebs appears to have form in outing people who do not agree with him. Back in 2014, he posted the CV of an individual who had written what he characterised as a bad review of a book he authored."

When British security researcher Marcus Hutchins asked whether doxxing a person for this was going a bit too far, his response was: "Dox people? Hardly. I think it helps to add context. The guy is a convicted cybercrook who's in jail. Of course he hates me."

Ouch. This is sad. I used to have a lot of respect for the guy.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#307

Post by [deleted] »

alltakendamned wrote: post #39

It seems you're not getting serious answers here, so here's my take. Please report this via the US-CERT at https://www.us-cert.gov/report This will allow you to report it, eventually from an anonymous email address, without exposing you directly to the bank which might react bad to you. CERT can handle the coordination with the bank, this is what they do.

[deleted]

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#308

Post by lawnchair_larry »

alltakendamned wrote: post #39

It seems you're not getting serious answers here, so here's my take. Please report this via the US-CERT at https://www.us-cert.gov/report This will allow you to report it, eventually from an anonymous email address, without exposing you directly to the bank which might react bad to you. CERT can handle the coordination with the bank, this is what they do.

I don’t think this is the type of thing US-CERT handles.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#309

Post by lawnchair_larry »

77pt77 wrote: post #236
zrobotics wrote: post #148

Earlier quoted context omitted.

Just checked to re-confirm: Wells Fargo passwords are case insensitive as well. This doesn't confirm that they store passwords in plaintext, as you said they may just convert to uppercase before hashing, but it is bad practice either way. There is a lot more possible entropy if QwErTy and QWERTY are distinct. However, there seems to be issues in the entire financial sector with inability to upgrade certain systems du…

> This doesn't confirm that they store passwords in plaintext They definitely store pincodes.

That doesn’t matter. Hashing something with such low entropy does nothing.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#310

Post by mam2 »

slumdev wrote: post #117

Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.

facebook too
Post reply on HN