9M Australians affected by Optus data breach • Hacker News Board

Re: 9M Australians affected by Optus data breach

#101

Post by frupert52 » Wed, Sep 28, 2022, 2:37 PM UTC

rstuart4133 wrote: post #81

triggercut wrote: post #71

Because of this I finally decided to complain to my (Australian) bank about their max 6 character (alphanumeric) no symbol password policy... And lack of MFA for personal accounts... And continuing to only offer OTP via SMS to authorise transactions. Well, I tried to complain... for you see after going through multiple pages/steps in the UI, when it came time to review and submit, after you press submit you are told…

> max 6 character (alphanumeric) no symbol password policy You forgot to add case isn't significant. Still, even such small passwords can be secure if managed right. It's been that way for many years, and I don't recall seeing anything about it being broken, so I guess it must be work ok. I doubt the ombudsman would care. On the other hand, every 10 or 20 logins, after logging in it doesn't display the internet banki…

The problem isn’t that the passwords are small, it’s that they aren’t being hashed. I wonder what level of data they are storing in plain text then?

Also if they aren’t able to accept other characters, I wonder what happens when you try?

I’ve worked “across” core payments(not banking) systems with the card schemes, westpac, St George etc. So I would say I’ve seen how bad things can get but your bank sounds like something next level.

Re: 9M Australians affected by Optus data breach

#102

Post by frupert52 » Wed, Sep 28, 2022, 2:50 PM UTC

tonteldoos wrote: post #88

exodust wrote: post #86

Earlier quoted context omitted.

Yep, my details were part of the breach unfortunately. I hate Optus now more than ever. I left them 2 years ago but they keep my details in a database accessible to the internet? Why? Details leaked are name, email, phone, DOB, home address, drivers license number. About 4 years ago I emailed them complaining that their marketing team were using my date of birth to send me "birthday deals" on my birthday. Something I…

Ah man, I'm sorry to hear that. No emails here yet, but not to say I'm not in the category one down yet (which is only slightly less bad). I'm starting to worry about the general public's understanding of the ramifications of this. When it first broke, I was pretty upset, and my partner (well educated, and with me long enough to understand some things about breaches) thought my concerns and anger at optus was excessi…

I wouldn’t normally get angry about something like this but when the CEO talked about how upset she was that there were people out there who would do such harm I almost blew my stack. The level of wilful ignorance to your responsibilities required to feel that statement could be appropriate is astounding.

But most of all, if you’ve worked anywhere even remotely resembling a professional organisation in the last 10 years then it should be obvious just how bad things are inside Optus for this to have even happened. Something is deeply wrong there. This kind of breach should have thousands of things standing in the way of it being possible

Re: 9M Australians affected by Optus data breach

#103

Post by rstuart4133 » Thu, Sep 29, 2022, 1:43 AM UTC

frupert52 wrote: post #101

rstuart4133 wrote: post #81

Earlier quoted context omitted.

> max 6 character (alphanumeric) no symbol password policy You forgot to add case isn't significant. Still, even such small passwords can be secure if managed right. It's been that way for many years, and I don't recall seeing anything about it being broken, so I guess it must be work ok. I doubt the ombudsman would care. On the other hand, every 10 or 20 logins, after logging in it doesn't display the internet banki…

The problem isn’t that the passwords are small, it’s that they aren’t being hashed. I wonder what level of data they are storing in plain text then? Also if they aren’t able to accept other characters, I wonder what happens when you try? I’ve worked “across” core payments(not banking) systems with the card schemes, westpac, St George etc. So I would say I’ve seen how bad things can get but your bank sounds like somet…

> The problem isn’t that the passwords are small, it’s that they aren’t being hashed.

How do you don't know they aren't hashed? Any what does that mean? Does it mean that are using DIGEST to avoid sending plain text over the https transport, or they aren't using key expansion for storage?

And does it matter? If someone gets into their internal systems leaked plain text passwords will be the least of their problems. Total deposits are $500 billion.

> I wonder what happens when you try?

Most people try, because they don't believe the restrictions. The answer is nothing out of the ordinary, of course. As I said, as far as I know it's never been broken. Which is kinda surprising, because their web site has more bugs than most. But it appears they've got that part right.

By the way, 6 alpha-numeric characters makes for about 1 billion combinations. The odds of guessing in it a few random goes are virtually nil, and then you are locked out and have prove your identify by via a third channel. Providing they police the max tries well, it's pretty secure.

> your bank sounds like something next level.

All the large banks hopeless. They are an absolutely nightmare to deal with on every level. This bank has been prosecuted by the Federal Government for AML violations - but again most of them have been prosecuted for grievous unethical behaviour. That doesn't make them insecure.

The OP is wrong about SMS 2 factor - they do support other methods, and insist on it once certain circumstances. The banks do protect themselves. In Australia, the history has been if they are forced to make up their customers losses. It takes years of investigations, and a lot of suffering in the mean time on the victims part. But the precedent is well established - karma is a real thing here, and the banks behave accordingly.

Re: 9M Australians affected by Optus data breach

#104

Post by Handytinge » Sat, Oct 01, 2022, 9:47 AM UTC

YPPH wrote: post #82

triggercut wrote: post #71

Because of this I finally decided to complain to my (Australian) bank about their max 6 character (alphanumeric) no symbol password policy... And lack of MFA for personal accounts... And continuing to only offer OTP via SMS to authorise transactions. Well, I tried to complain... for you see after going through multiple pages/steps in the UI, when it came time to review and submit, after you press submit you are told…

Password length isn't necessarily cause for concern in this context. See: https://www.troyhunt.com/banks-arbitrary-password-restrictio... As for MFA, the only Australian bank that seems to do it right is Macquarie (who let you remove SMS 2FA and replace it with a decent authenticator app). A handful will issue physical tokens on request (eg HSBC).

Bendigo also do physical tokens as well as app based 2FA.

Macquarie have unpersoned me before (cancelled all of my accounts with no explaination or notice, on a Friday afternoon). I've heard of it happening to others too. As such, I make it my mission whenever dealing with large scale finance in business to refuse to deal with them.