Ask HN: A major USA bank is storing passwords in cleartext – what to do?

Post by reinkaos » Thu, Feb 20, 2020, 4:18 AM UTC

the_french wrote: post #89

chris_overseas wrote: post #80

One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characters long(!) consisting only of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password: https://banking.westpac.com.au/ I complained to them about this…

Even worse, a major French bank removed their perfectly fine password requirements and replaced it with a 6 digit PIN that you have to enter via an on-screen numpad. They explicitly block password managers from autofilling too! And I had just managed to get my parents to start using one.

Post by nelgaard » Thu, Feb 20, 2020, 9:56 AM UTC

EGreg wrote: post #140

lb1lf wrote: post #123

Earlier quoted context omitted.

> I definitely have Bank of America notify me when I do something out of the ordinary. -And such routines are incredibly efficient; while commissioning one of our deliveries (heavy engineering equipment) in Namibia a few years ago, I found that the local power electronics distributor hadn't heard of my employer, and were (reasonably so) reluctant to hand over parts for $13,000 or so and send an invoice to Norway. VIS…

I have one question We have all these stories of how our feudal lords have been nice and helpful But why not get the notifications yourself on your own devices? You can set up your own policies for approving transactions or whatever. I understand that the chargebacks can be done up to 60 days, which means “seller beware” in the current financial system as opposed to “buyer beware” in the crypto one. But in the crypto…

Post by austincheney » Thu, Feb 20, 2020, 12:54 PM UTC

dontbenebby wrote: post #223

alltakendamned wrote: post #39

It seems you're not getting serious answers here, so here's my take. Please report this via the US-CERT at https://www.us-cert.gov/report This will allow you to report it, eventually from an anonymous email address, without exposing you directly to the bank which might react bad to you. CERT can handle the coordination with the bank, this is what they do.

This very looks cool, thank you for sharing parent. I apologize for the nitpick, but I hope there will be some guidance on what an "anonymous" email is. (Ex: Guerilla at a public wifi like a library, an email created at a library, but not your usual email from a place other than your home) I worry sometimes that we assume people reporting security vulnerabilities will be security experts. I often meet people who are…

Post by cjbprime » Fri, Feb 21, 2020, 6:33 PM UTC

cjbprime wrote: post #279

micheljansen wrote: post #235

Really shocked at all the handwavy comments. > “It’s fine, there are more checks in place to prevent unauthorised transactions” > “Also, it’s insured” Well ok, that means the bank is protected, but what about my (sensitive) data such as transaction history? > “If anyone does anything bad, law enforcement will step in” Yeah, I totally trust a bank that can’t even properly deal with something as basic as passwords to n…

> Well ok, that means the bank is protected, but what about my (sensitive) data such as transaction history? If I recall, they already sell that to other companies. (It might not have your real name attached, but any one of the companies you purchased from can deanonymize it by cross-referencing their own charge log.)