Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

281–290 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#281

Post by ta999999171 »

bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

People, if you work for these companies, you legitimize their practices, and make it easier for them to keep existing.

No, I don't care that you've grown accustomed to your fancy lifestyle.

No, I don't care that your spouse is gonna shit on you if you take a pay cut until you can find similar work.

No, I don't care that "someone else will take your place and do the same thing".

Sorry - stand up for what's right, or this shit will continue to get worse.

Engineering/architecture have some principles, why the hell shouldn't we?

Signed, Someone Who Left Their Comfy Salary Because of Unethical Wankers

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#282

Post by o-__-o »

carterehsmith wrote: post #212
kevin_thibedeau wrote: post #141

Earlier quoted context omitted.

So they can add columns for 2FA but strengthened password storage is not doable? This was forgivable 30 years ago. It was bad practice 20 years ago. Someone could have demonstrated leadership and developed a ten year plan to fix their legacy problem then.

Yeah, this "we can't extend password beyond 8 characters because legacy systems" argument does not hold water. My experience: built a Web site/app for: a) major bank b) major corp, back in the days when Web presence was kind of a new thing. ~15-20 years ago. You build a new (Web) app and treat the legacy system (happened to be some mainframe) as a backend or whatever. Add new tables to hold user's credentials, email…

Until 3 years ago, J.P. Morgan chase would only store the first 8 characters of your password. They would accept more but silently discard it

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#283

Post by diffeomorphism »

matz1 wrote: post #127
diffeomorphism wrote: post #114

Earlier quoted context omitted.

..., but I don't care how it is implemented as long as it is secure. I totally agree with this part. The problem is that the security of the implementation is the security of the implementation. So your sentence reads: This is implemented extremely insecurely, but I don't care how it is implemented as long as it is secure. I also don't care about water, as long as it is dry.

Yes, at the end of the day, as long as the money is there when i need it, I don't really care how you store it.

You stopped reading after the first sentence?

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#284

Post by vegardx »

rimliu wrote: post #271
vegardx wrote: post #221

It never ceases to amaze me what the state of online banking is around the world. Here we have something called BankID which comes in two flavors, one that is a physical token that generates TOPT used to log in, either in a combination with a password or a PIN on the token device itself, referred to as BankID. And the other, much slicker solution, called BankID on Mobile, which runs as SIM-application on your phone w…

Sweden? Here (Baltics) we have SmartID or mobile signature or hardwire password generators (TOTP). No stupid passwords.

Norway, but I would imagine it's the same or same-ish solution given that banks in Scandinavia and Baltics operate more or less the same way.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#285

Post by altacc »

kevin_thibedeau wrote: post #141
bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

So they can add columns for 2FA but strengthened password storage is not doable? This was forgivable 30 years ago. It was bad practice 20 years ago. Someone could have demonstrated leadership and developed a ten year plan to fix their legacy problem then.

> This was forgivable 30 years ago.

A lot of the mainframe systems running large organisations were written more than 30 years ago and are still the core of the business, so their limitations are the constraints everyone else works around.

> Someone could have demonstrated leadership and developed a ten year plan to fix their legacy problem then.

The large project I work on is 12 years into replacing the mainframe platforms which have run the business for 45+ years, and we're not even halfway through the portfolio. Do not underestimate the complexity of these mainframes and the time & cost needed to fully replace them.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#286

Post by aembleton »

IncRnd wrote: post #232
carterehsmith wrote: post #212

Earlier quoted context omitted.

Yeah, this "we can't extend password beyond 8 characters because legacy systems" argument does not hold water. My experience: built a Web site/app for: a) major bank b) major corp, back in the days when Web presence was kind of a new thing. ~15-20 years ago. You build a new (Web) app and treat the legacy system (happened to be some mainframe) as a backend or whatever. Add new tables to hold user's credentials, email…

>> Add new tables to hold user's credentials, email addresses, and whatever else. Adding a table to hold users' credentials doesn't really solve the problem that is being discussed, which is storing users' credentials. All that does is add a new attack surface, stealing the new credentials, and the original credentials are still in the same position.

You can salt and hash the new password; and the old password can be in plain text. The old password being in plain text doesn't matter so much if it is not possible to access the legacy system directly from outside of the banks network.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#287

Post by valtism »

Wheaties466 wrote: post #76
_Understated_ wrote: post #62

Why not reach out to someone like Brian Krebs? He has a pretty large reach and can potentially make people take notice. Try @briankrebs on Twitter.

Alternatively I feel like Troy Hunt may also be able to help https://twitter.com/troyhunt He runs the @haveibeenpwned service

Troy is usually reeeaaally busy and he may not have time to jump on this one case.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#288

Post by dx034 »

marcus_holmes wrote: post #186
moviuro wrote: post #171

Earlier quoted context omitted.

> developed a ten year plan to fix their legacy problem then They did. And Pi factor came in. And budget was cut because those pesky fintech are a threat, and clearly money was better spent on a more modern offer than on those "security" concerns. And yes, it's possible to add 2FA to the front layer. However, the remnants of COBOL code running on the mainframe for the last 25 years weren't designed to handle password…

That COBOL layer that underlies almost all of our infrastructure. It was written when the cost/benefit calculation of writing it involved "downsizing" thousands of clerks who were doing the job manually. It can't be replaced because the cost/benefit calculation of replacing it does not involve anything like those kinds of numbers. The benefits of avoiding even a major security incident just don't compare to the costs…

Some banks are replacing their core banking system with new software. It's extremely expensive, a huge risk (any delay in migration means time where customers can't use ATMs or cards) and the benefit vs just adding API layers on top isn't always clear. At some point everyone needs to modernize but there are very few people who'd want to take responsibility for a project that size.

TSB customers have learned how painful it can be if the migration of a core banking system fails: https://www.independent.co.uk/news/business/news/tsb-it-fail...

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#289

Post by dx034 »

obmelvin wrote: post #204
bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

Honestly, this is bananas to me. I work for an IoT company with contracts to places like gas stations and chain restaurants. Freakin Wendy's and places like that absolutely don't want our product on their network and we have a base station connected to cell network along with our own local wireless network. (fwiw I agree, I think its best we aren't on their network) I know this is an apples to oranges comparison, but…

I don't think network security is the issue here. Storing plain text passwords is likely a legacy problem, not an active implementation decision. And especially because some systems within the network can be vulnerable, locking down the network as much as possible at every possible point is even more important. Core banking systems can only run on 50 year old code because you have to get through many layers just to get close to accessing them.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#290

Post by dx034 »

allemagne wrote: post #143
bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

>How much ripping would HN impose on one of these institutions if they attempted a 100% best practices secure password upgrade and then subsequently had a complete IT disaster unfold (I can certainly link articles). I'm definitely interested in examples of this

TSB had a major IT meltdown when it tried to migrate to a different core banking system: https://www.independent.co.uk/news/business/news/tsb-it-fail...
Post reply on HN