5 ms·

Yes. This is to protect against attackers obtaining your full plaintext password on your end, for example by phishing or installing keyloggers. In practice this

by makomk 10y ago

Yes. This is to protect against attackers obtaining your full plaintext password on your end, for example by phishing or installing keyloggers. In practice this is a much bigger security threat in the online banking world than someone doing the same by compromising the bank's systems - even if that were to happen they can easily re-verify your identity and issue you with a new password, and you really shouldn't be using the same password elsewhere.

MereInterest 10y ago
Phishing is a much bigger security threat, but is a much less harmful one than having the password database stolen. It sounds like they are trying to minimize the day-to-day risks, at the expense of maximize the damage of a catastrophic event.
- kybernetikos 10y ago
  All the systems I've used that do this make you have two passwords, only one of which they are storing in a reversible way.
- makomk 10y ago
  If the password database is stolen somehow, that probably means that the bank's online banking systems have been compromised. Having the password database stolen is likely to be the least of their worries at that point.
chris_wot 10y ago
How does this prevent key logging attacks? You still type in those characters. And secondly, that just immediately made it a hell of a lot easier to brute force your way through the passwords!
- k-mcgrady 10y ago
  It asks for different characters from the password each time. So it'll ask for the 1st, 4th, and 5th characters. Next time you go to login it'll ask from 2nd, 8th, 14th. So a key logger is only getting a small portion of the password each time.
  - coldtea 10y ago
    So they attacker just has to run the keylogger for enough time...
    - dkersten 10y ago
      Only if they also capture the website output so they know which logged key press represents which character of the password.
    - tim333 10y ago
      Yeah I was thinking they could do that. You'd only need to record a few logins. Re brute forcing, some like firstdirect make you type a word as well and they probably block you after 3 fails so it would be quite hard to brute force. Tddirectinvesting only ask a 7 digit account number and 3 digits from the password so you could probably brute force coms of those with a botnet though they only let you transfer money to a pre nominated bank account so it would still be hard to nick people's money.
    - EToS 10y ago
      They also use 2FA i believe.. but then it makes logging in a right pain the ass for customers: 1) track down your massive identity number 2) enter 2nd, 5th, 8th characters of your password 3) locate your 2FA code from the HSBC device they send.
    - dogma1138 10y ago
      The attacker needs to both be able to read the page and key log every keystroke and be able to associate as single letter, digit, or symbol to you password and not only that to the correct placement within the password. This is virtually impossible to achieve by any effective means. They ask random characters from your password in a random order if you login into your bank twice a week it most likely will a year or more until a some one can phish your entire password from you this is not scaleable.
      - coldtea 10y ago
        >This is virtually impossible to achieve by any effective means. Actually it's very simple to achieve. First, those digits will not be randomly placed among all the things you've typed, but they'd follow some specific patterns (the most obvious one being you typing all of part --due to autocomplete-- of the bank's url). (Of course if you can run a keylogger you can also check what website is loaded on the browser and log that information alongside the keys too, but you don't even need to go that far). So, we established that the attacker checking the keylogger logs can trivially tell - "now they're typing their banking password". If they also knew the correct placement that would be handy, but they can do without it too. Just knowing those N characters are from your password (in any order) really improves the possibilities they need to search. Even if it takes a year, either they are very dedicated to you as a special (large bank account) profile target, so they can wait, or they are logging tens of thousands, via some malware, so it's still worth it to wait.
- ryanlol 10y ago
  And they totally wont kill the account after a couple of wrong attempts, right?
pierrec 10y ago
It's a ridiculous practice and storing the passwords in plaintext is deplorable. Banks have your phone number, (which can't simply be changed online) and that is the best additional line of security. The scrambled on-screen keyboard / n-th character request only poorly "protects" against cases where the attacker has full root access to the customer's machine (how would it protect against phishing?), and in those cases the attacker is likely already capable of making all kinds of payments, even without access to the online banking account. If security is done properly, an attacker can't make direct use of a banking account anyways: creating a new transfer recipient should require phone confirmation by default.
- GhotiFish 10y ago
  you know. It occurs to me that you could actually do this without storing the password in plaintext! All you'd have to do is iterate every potential answer into a bloom filter and store that. The math gets a little hairy around the 50 character mark as you'd have 117600 operations to do to construct the bloom filter, and it gets worse if you expect more characters. Here's how you would construct it. For every 3 choose n of the password, insert a value of those 3 characters ("abc") + delimit (":") + the positions (1,2,4), You can't just insert the characters because the index of characters is part of the answer. all you'd need to do is store... a ~1MB bloom filter per client. Huh, that number was bigger than I thought it would be. Well nevermind. Fun thought though.
  - Vexs 10y ago
    Realistically you could also just limit it to the first 10 characters.
pavel_lishin 10y ago
I wonder how often people just type out the full password into the address bar or into notepad, and then start counting to find the nth digit.
- christianmann 10y ago
  Don't be ridiculous. They probably type it into Microsoft Word.
- Gaelan 10y ago
  I hope not the address bar, as that goes to Google (or $searchEngine) for autocomplete.
beached_whale 10y ago
Except attackers usually get the passwords from other sites' databases that do the same thing and don't use proper backend hashing/salting
stouset 10y ago
If someone has that level of access to your system, they can just send themselved the session cookie. Or if the cookie is tied to an IP address, they can just make requests with that cookie from the compromised machine. If an attacker is running code on your system, you are already lost.

by makomk 10y ago

MereInterest 10y ago

Phishing is a much bigger security threat, but is a much less harmful one than having the password database stolen. It sounds like they are trying to minimize the day-to-day risks, at the expense of maximize the damage of a catastrophic event.

kybernetikos 10y ago
All the systems I've used that do this make you have two passwords, only one of which they are storing in a reversible way.
makomk 10y ago
If the password database is stolen somehow, that probably means that the bank's online banking systems have been compromised. Having the password database stolen is likely to be the least of their worries at that point.

chris_wot 10y ago

How does this prevent key logging attacks? You still type in those characters. And secondly, that just immediately made it a hell of a lot easier to brute force your way through the passwords!

k-mcgrady 10y ago
It asks for different characters from the password each time. So it'll ask for the 1st, 4th, and 5th characters. Next time you go to login it'll ask from 2nd, 8th, 14th. So a key logger is only getting a small portion of the password each time.
- coldtea 10y ago
  So they attacker just has to run the keylogger for enough time...
  - dkersten 10y ago
    Only if they also capture the website output so they know which logged key press represents which character of the password.
  - tim333 10y ago
    Yeah I was thinking they could do that. You'd only need to record a few logins. Re brute forcing, some like firstdirect make you type a word as well and they probably block you after 3 fails so it would be quite hard to brute force. Tddirectinvesting only ask a 7 digit account number and 3 digits from the password so you could probably brute force coms of those with a botnet though they only let you transfer money to a pre nominated bank account so it would still be hard to nick people's money.
  - EToS 10y ago
    They also use 2FA i believe.. but then it makes logging in a right pain the ass for customers: 1) track down your massive identity number 2) enter 2nd, 5th, 8th characters of your password 3) locate your 2FA code from the HSBC device they send.
  - dogma1138 10y ago
    The attacker needs to both be able to read the page and key log every keystroke and be able to associate as single letter, digit, or symbol to you password and not only that to the correct placement within the password. This is virtually impossible to achieve by any effective means. They ask random characters from your password in a random order if you login into your bank twice a week it most likely will a year or more until a some one can phish your entire password from you this is not scaleable.
    - coldtea 10y ago
      >This is virtually impossible to achieve by any effective means. Actually it's very simple to achieve. First, those digits will not be randomly placed among all the things you've typed, but they'd follow some specific patterns (the most obvious one being you typing all of part --due to autocomplete-- of the bank's url). (Of course if you can run a keylogger you can also check what website is loaded on the browser and log that information alongside the keys too, but you don't even need to go that far). So, we established that the attacker checking the keylogger logs can trivially tell - "now they're typing their banking password". If they also knew the correct placement that would be handy, but they can do without it too. Just knowing those N characters are from your password (in any order) really improves the possibilities they need to search. Even if it takes a year, either they are very dedicated to you as a special (large bank account) profile target, so they can wait, or they are logging tens of thousands, via some malware, so it's still worth it to wait.
ryanlol 10y ago
And they totally wont kill the account after a couple of wrong attempts, right?

pierrec 10y ago

It's a ridiculous practice and storing the passwords in plaintext is deplorable. Banks have your phone number, (which can't simply be changed online) and that is the best additional line of security. The scrambled on-screen keyboard / n-th character request only poorly "protects" against cases where the attacker has full root access to the customer's machine (how would it protect against phishing?), and in those cases the attacker is likely already capable of making all kinds of payments, even without access to the online banking account. If security is done properly, an attacker can't make direct use of a banking account anyways: creating a new transfer recipient should require phone confirmation by default.

GhotiFish 10y ago
you know. It occurs to me that you could actually do this without storing the password in plaintext! All you'd have to do is iterate every potential answer into a bloom filter and store that. The math gets a little hairy around the 50 character mark as you'd have 117600 operations to do to construct the bloom filter, and it gets worse if you expect more characters. Here's how you would construct it. For every 3 choose n of the password, insert a value of those 3 characters ("abc") + delimit (":") + the positions (1,2,4), You can't just insert the characters because the index of characters is part of the answer. all you'd need to do is store... a ~1MB bloom filter per client. Huh, that number was bigger than I thought it would be. Well nevermind. Fun thought though.
- Vexs 10y ago
  Realistically you could also just limit it to the first 10 characters.

pavel_lishin 10y ago

I wonder how often people just type out the full password into the address bar or into notepad, and then start counting to find the nth digit.

christianmann 10y ago
Don't be ridiculous. They probably type it into Microsoft Word.
Gaelan 10y ago
I hope not the address bar, as that goes to Google (or $searchEngine) for autocomplete.

beached_whale 10y ago

Except attackers usually get the passwords from other sites' databases that do the same thing and don't use proper backend hashing/salting

stouset 10y ago

If someone has that level of access to your system, they can just send themselved the session cookie. Or if the cookie is tied to an IP address, they can just make requests with that cookie from the compromised machine. If an attacker is running code on your system, you are already lost.