Schwab password policies and two factor authentication • Hacker News Board

Re: Schwab password policies and two factor authentication

#111

Post by DrJosiah » Tue, Dec 23, 2014, 1:13 AM UTC

cdolan wrote: post #70

DrJosiah wrote: post #66

Earlier quoted context omitted.

Did you read the article?

While I see your implied point, DrJosiah, the above commenter did not say that the authenticator was without issue. Moreover, the blog post did not attempt to prove that the 2 factor auth did not work IF configured properly, but that the UI was incredibly misleading when activating the token.

Go read the article (or the first 2 paragraphs even), then come back and read the comment.

The point of the article was that Schwab's login security is so broken, even when you do all of the right things yourself, Schwab's implementation of passwords and 2-factor auth may make you think that everything worked when it didn't.

It is my opinion that someone who had read the article, had a Schwab account, and who had enabled 2-factor auth for that account would have responded to or added to the experiences expressed by Jeremy Tunnell. But there are no words in acconrad's post that leads me to believe that they read the article before posting, as it basically amounts to, "When I contacted them about crappy password security, I ended up with a 2-factor fob. You should get one too." ... which is great advice for any system offering 2-factor auth, but it basically ignores the whole purpose of the article, which was to point out how utterly broken the entire process is.

Could I be wrong and acconrad actually read the article first? Sure. But I asked a question which embodied my opinion on the matter, based on what I read up until that point. And so far, I've not seen any evidence to the contrary to change my belief that acconrad commented without reading the article (your reply doesn't contain information/evidence that is applicable to the question that I asked, as I have at no point offered an opinion that you are responding to).

But I've spent entirely too long replying, and won't be following up further. Good day.

Re: Schwab password policies and two factor authentication

#112

Post by cdolan » Tue, Dec 23, 2014, 1:17 AM UTC

ufmace wrote: post #98

I've been coming to an opinion on these issues that may be unpopular with the tech crowd: The big banks have the right idea when it comes to security, and we are misguided at best with our obsession over the minutia of password handling. Why? All of these big banks and investment houses have holdings in the neighborhood of billions of dollars. Like billions in actual cash. If they are so vulnerable and insecure, why…

Excuse the short answer, with family for the evening. In short I think that the reason you see hackers target web startups and credit cards is because you can get away with it. Example - it's easy to use a credit card, buy something online, and have it shipped to a big office or apartment.

And to steal from a bank account? You'd need another bank account! Bank accounts require you to put up your own personal info, which is a huge barrier for Off shore hackers to overcome

Re: Schwab password policies and two factor authentication

#113

Post by brianpgordon » Tue, Dec 23, 2014, 3:00 AM UTC

ufmace wrote: post #98

I've been coming to an opinion on these issues that may be unpopular with the tech crowd: The big banks have the right idea when it comes to security, and we are misguided at best with our obsession over the minutia of password handling. Why? All of these big banks and investment houses have holdings in the neighborhood of billions of dollars. Like billions in actual cash. If they are so vulnerable and insecure, why…

Did you finish the article? At the end the author claims that their two-factor authentication can be defeated by appending extra characters to your password. In other words, they have no two-factor authentication. This isn't a matter of differing points of view, this is objectively awful.

With computer security, you have to obsess over the minutia because a single vulnerability is all it takes to defeat the system.

Re: Schwab password policies and two factor authentication

#114

Post by PhantomGremlin » Tue, Dec 23, 2014, 3:14 AM UTC

deet wrote: post #23

Not that this is an excuse, but keep in mind that Schwab probably has had the mentality that a compromise of a user's online account, while bad, is not the end of the world. They have been frustratingly slow in implementing features like linking external bank accounts using trial deposits instead of mailing them a voided check from the external account. Their slowness to adopt these new features has meant that if you…

> Schwab probably has had the mentality that a compromise of a user's online account, while bad, is not the end of the world

Hmmm. Where have we heard that before? Yes, Sony!!! There's probably a better link but here is the first one I found:[1]

   Back in 2007, Jason Spaltro, then the executive
   director of information security at Sony Pictures 
   Entertainment, was shockingly cavalier about
   security in an interview with CIO Magazine.
   He said it was a “valid business decision to
   accept the risk” of a security breach, and that
   he wouldn’t invest $10 million to avoid a
   possible $1 million loss.

Has anyone heard recently about how that's working out for them? :)

[1] http://fusion.net/story/31469/sony-pictures-hack-was-a-long-...

Re: Schwab password policies and two factor authentication

#115

Post by ufmace » Tue, Dec 23, 2014, 4:15 AM UTC

superuser2 wrote: post #108

ufmace wrote: post #98

I've been coming to an opinion on these issues that may be unpopular with the tech crowd: The big banks have the right idea when it comes to security, and we are misguided at best with our obsession over the minutia of password handling. Why? All of these big banks and investment houses have holdings in the neighborhood of billions of dollars. Like billions in actual cash. If they are so vulnerable and insecure, why…

A substantial volume of low-level fraud occurs every day and is baked into the cost of doing business because that costs less than reengineering fundamentally insecure systems. A system where you can pull money by knowing a set of "secret" numbers shared with every entity an account holder has ever done business with is just insane to begin with. We rely on reading transactions after the fact looking for red flags. Y…

There's some truth to all that, but I'd say it's kind of another point. We don't have and never really did have a logically secure finance system. We have a human-secured finance system instead, where for virtually every transaction, there is a human somewhere who has the power to review and reverse it. It seems clumsy to the programmer's mind, but it largely works pretty well.

I don't think we even have a really solid idea what a logically secure financial system would look like, how to build it, or if it's practical. Bitcoin seems to be the closest and most practical thing we have so far to that. While Bitcoin is cool and interesting in a lot of ways, the practical security of it leaves much to be desired, based on the observed results so far.

Re: Schwab password policies and two factor authentication

#116

Post by ossreality » Tue, Dec 23, 2014, 4:25 AM UTC

darken wrote: post #84

cddotdotslash wrote: post #48

I just called Schwab about this, and hand to whatever deity you believe in, this is what he told me: Representative: "One of the things we were trying to do with these passwords was make them different from other providers. So we know that they allow multiple character types, and are case-sensitive, so we decided to make them different. That way, you can't use the same password you've used elsewhere and it kind of fo…

This justification actually makes some sense to me (Software engineer familiar with crypto.) If an attacker already has access to the password hashes, then yes, they can brute force any 8 character case-insensitive password easily. However, a brute force "try to login to their site" attack isn't feasible without hitting a rate limit or alarm: (26+10)^8 = 2.8*10^12 is still a lot of attempts to login to an account. Th…

You have to be kidding me.

Too bad you used a throwaway so we can't look out for you to avoid hiring you.

Re: Schwab password policies and two factor authentication

#117

Post by ufmace » Tue, Dec 23, 2014, 4:31 AM UTC

brianpgordon wrote: post #113

ufmace wrote: post #98

I've been coming to an opinion on these issues that may be unpopular with the tech crowd: The big banks have the right idea when it comes to security, and we are misguided at best with our obsession over the minutia of password handling. Why? All of these big banks and investment houses have holdings in the neighborhood of billions of dollars. Like billions in actual cash. If they are so vulnerable and insecure, why…

Did you finish the article? At the end the author claims that their two-factor authentication can be defeated by appending extra characters to your password. In other words, they have no two-factor authentication. This isn't a matter of differing points of view, this is objectively awful. With computer security, you have to obsess over the minutia because a single vulnerability is all it takes to defeat the system.

I did, and that is a pretty epic screwup. But in the end, it seems that the cost of them screwing that up, aside from maybe a few techies cancelling their accounts, is zero.

I'd say that more than obsessing over the minutia, you have to obsess over the entirety of the system as used in practice, of which the authentication system is only a small part. I don't know finance that well so I'm kinda spitballing here, but stuff like exactly how the system that approves transactions actually communicates with the systems authorized to actually move money, what types of transactions are allowed and to where, what kind of checking is done against various transaction types, how to correlate to the user's activity history. If user normally connects from Atlanta and uses an online billpay system to send checks to a handful of companies, be very suspicious and probably flag and review the transaction if somebody suddenly logs in from a different address and requests a wire transaction to a foreign bank, etc.

The evidence (lack of constant ripoffs) suggests that they are quite good indeed at obsessing over the minutia of the rest of the system. This allows them to get away with authentication practices that are, depending on your point of view, somewhere between actively awful and bending over well past backwards to make things simpler and less error-prone for unsophisticated users. Got any idea how many users with 7-figure or more account balances still want to login on their flip-phones, bank online with IE6 on WinXP, use their account even after they epically screw up their password or their TFA key, etc? Neither do I, but I bet it's a lot higher than any of us would like.

Re: Schwab password policies and two factor authentication

#118

Post by jeremyt » Tue, Dec 23, 2014, 4:47 AM UTC

brianpgordon wrote: post #113

ufmace wrote: post #98

I've been coming to an opinion on these issues that may be unpopular with the tech crowd: The big banks have the right idea when it comes to security, and we are misguided at best with our obsession over the minutia of password handling. Why? All of these big banks and investment houses have holdings in the neighborhood of billions of dollars. Like billions in actual cash. If they are so vulnerable and insecure, why…

Did you finish the article? At the end the author claims that their two-factor authentication can be defeated by appending extra characters to your password. In other words, they have no two-factor authentication. This isn't a matter of differing points of view, this is objectively awful. With computer security, you have to obsess over the minutia because a single vulnerability is all it takes to defeat the system.

Author here. To be fair, the bug only prevents you from activating 2fa. If you manage to activate it, it seems to work fine.

Re: Schwab password policies and two factor authentication

#119

Post by CamperBob2 » Tue, Dec 23, 2014, 5:09 AM UTC

darken wrote: post #84

cddotdotslash wrote: post #48

I just called Schwab about this, and hand to whatever deity you believe in, this is what he told me: Representative: "One of the things we were trying to do with these passwords was make them different from other providers. So we know that they allow multiple character types, and are case-sensitive, so we decided to make them different. That way, you can't use the same password you've used elsewhere and it kind of fo…

This justification actually makes some sense to me (Software engineer familiar with crypto.) If an attacker already has access to the password hashes, then yes, they can brute force any 8 character case-insensitive password easily. However, a brute force "try to login to their site" attack isn't feasible without hitting a rate limit or alarm: (26+10)^8 = 2.8*10^12 is still a lot of attempts to login to an account. Th…

Rate-limiting is important, and almost universally practiced, but it doesn't have anything to do with the problem with short passwords. When the password database inevitably gets hacked and uploaded to Pastebin, it's too late for rate limiting.

Re: Schwab password policies and two factor authentication

#120

Post by jcrawfordor » Tue, Dec 23, 2014, 5:21 AM UTC

ryan-c wrote: post #42

modeless wrote: post #8

I filed a support ticket about the password length. They told me it was due to "government standards" and they would reevaluate after a new standard came out. I didn't inquire further into this obvious BS. They provide a good service otherwise so it's strange that they have this blind spot.

The modern government standard for classified systems is 15 characters minimum.

My guess would be that by "government standards" they were referring to PCI-DSS (actually an industry group standard), which in the current version requires passwords of at least 7 characters and with at least letters and numbers (PCI-DSS v3.0 8.2.3).

...However, the standard explicitly permits any other password requirement of the same or greater entropy.

...However, these requirements do not apply to consumer accounts at all (!). As far as I can tell, PCI-DSS actually has no requirements whatsoever for safeguarding of consumer user accounts. The more you know, the more you worry.