Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

151–160 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#151

Post by tantalor »

bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

> For many banks and other financial institutions, going down for even 1 hour is a complete catastrophe.

Are you joking? It's a common trope for bank websites to go down for "scheduled maintenance". Not to mention real-world bank branches keep bizarre hours and close for random holidays like Presidents' Day and Veterans' Day.

Why do banks and credit card companies need to perform "scheduled maintenance" during which users are unable to access their information online? https://www.quora.com/Why-do-banks-and-credit-card-companies...

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#152

Post by slumdev »

zrobotics wrote: post #148
slumdev wrote: post #117

Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.

Just checked to re-confirm: Wells Fargo passwords are case insensitive as well. This doesn't confirm that they store passwords in plaintext, as you said they may just convert to uppercase before hashing, but it is bad practice either way. There is a lot more possible entropy if QwErTy and QWERTY are distinct. However, there seems to be issues in the entire financial sector with inability to upgrade certain systems du…

My gut reaction to your story would be to assume that your local credit union is doing a better job than the big banks, not that there's a good explanation for the big banks.

Credit unions frequently also offer better mortgage APRs, better savings APYs, better customer service, lower (or no) ATM fees, etc.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#153

Post by moftz »

the_french wrote: post #89
chris_overseas wrote: post #80

One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characters long(!) consisting only of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password: https://banking.westpac.com.au/ I complained to them about this…

Even worse, a major French bank removed their perfectly fine password requirements and replaced it with a 6 digit PIN that you have to enter via an on-screen numpad. They explicitly block password managers from autofilling too! And I had just managed to get my parents to start using one.

I got firefox to remember passwords for a couple sites that were blocking autofill. It involved opening up the xml file where passwords are stored, copying the latest entry, changing the url and ID number, then opening up the password manager in firefox and updating the actual password there since the XML file only stores an encrypted version. It wouldn't autofill instantly, had to click on the username box to get it to work but it saved me a lot of time from entering a massive password that system required.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#154

Post by generalpass »

tentboy wrote: post #142
bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

As someone who uses the bank being referred to in the OP, this makes me feel a little better... somehow. I use a unique password and 2FA and monitor my accounts but I am still considering switching banks to one that puts more emphasis on security. You mentioned that only a few banks have the resources to tear down their systems and create a new secure one. What banks are these?

You can have maybe 3 banks types of accounts:

1. This has electronic transactions freely going in and out.

2. This initiates inbound electronic transactions.

3. This only works with you standing in the bank.

Or some variant thereof.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#156

Post by bob1029 »

allemagne wrote: post #143
bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

>How much ripping would HN impose on one of these institutions if they attempted a 100% best practices secure password upgrade and then subsequently had a complete IT disaster unfold (I can certainly link articles). I'm definitely interested in examples of this

Here is one recent example I just dug up:

https://www.itnews.com.au/news/massive-cba-outage-traced-to-...

Not specifically related to password security upgrade, but it illustrates the impact of a bank's IT systems going down. Being able to run a credit card transaction and receive your paycheck is fundamental to the fabric of our society. When these processes are disrupted, people get very anxious and things start to fall apart rapidly. When is the last time you insert your card into the reader and thought "I sure hope this works"?

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#157

Post by tzs »

bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

> Ultimately, it's not some malicious intent or incompetence, but simply the acknowledgement that the legacy systems will not enjoy PBKDF hash+salt+iterations columns being added 30 years after the fact.

Are banks running their web interface on 30+ year old legacy systems? I'd expect the web stuff to be on much more modern systems, which call upon the 30+ year old stuff to do the underlying financial stuff.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#160

Post by daveoc64 »

Recursing wrote: post #147
daveoc64 wrote: post #87

Earlier quoted context omitted.

To whom, and on what basis? There is nothing in UK law that says banks have to store your passwords "securely". Issues like this have been raised in the past, and authorities like the ICO have said no law is being broken. GDPR, for example, does not specify technical mechanisms required to store any form of data.

See https://news.ycombinator.com/item?id=22356101

Unfortunately, they are still non-committal on what is required. They advise that passwords should be hashed, but there is nothing that makes that a binding requirement.

The gist is still "do what you think is appropriate".

The ICO talks about balancing risks and convenience, and the banks will argue that their systems are secure overall, and don't make the consumer liable anyway.

Under the ICO's guidance, an organisation could argue that plain text (or reversibly encrypted) passwords allow them to do things like password reminders.

You or I might think that's terrible, but they can argue that it's a better user experience.

Post reply on HN