4 ms·

I wrote this a couple years ago about Schwab's embarrasing security. Most of the issues are still there. https://jeremytunnell.com/2014/12/22/swab-password-po

by jeremyt 10y ago

I wrote this a couple years ago about Schwab's embarrasing security. Most of the issues are still there. https://jeremytunnell.com/2014/12/22/swab-password-policies-and-two-factor-authentication-a-comedy-of-errors/ https://jeremytunnell.com/2014/12/22/swab-password-policies-...

oogali 10y ago
FYI, Password + token is a common pattern in systems where hardware/software/OTP tokens were bolted on after the fact. Not just that, but on certain systems (think a Windows login screen, or a POP3/IMAP login for your e-mail client), you can't have a 3rd "token" field -- they're hardcoded to ask for just a username and password. So vendors came up with the idea of appending the token value onto the password, and their middleware (say, a PAM module) splits the provided value into password and token and validates both. EDIT: That's not to say that Schwab is doing it right (in the front-end, seriously???), but just pointing it it's not as uncommon as you think.
- jodrellblank 10y ago
  RADIUS backend to network equipment as well. Since RADIUS is old, it doesn't have great password hash/encryption support (afaik), so you don't use it over open networks already, and it's well entrenched / widely supported. So have it with no encryption, and the back-end can pull the password and 2FA code apart and verify both of them, for all kinds of systems which have only a username/password prompt for logins.
raybb 10y ago
Wow, how has this not gotten more attention?
- Atheros 10y ago
  It has. It's just been like that for years.
asafira 10y ago
Are most of these actually still there? The password requirements have changed dramatically in the last 6 months.
- jeremyt 10y ago
  Well if true, I stand corrected. I have received no communication from Schwab about any changes. I assume that if they had made stronger passwords available, for example, they would notify their customers. I no longer hold any assets at Schwab, but I do poke around every now and then, and it's possible they changed things without me noticing.

by jeremyt 10y ago

oogali 10y ago

FYI, Password + token is a common pattern in systems where hardware/software/OTP tokens were bolted on after the fact. Not just that, but on certain systems (think a Windows login screen, or a POP3/IMAP login for your e-mail client), you can't have a 3rd "token" field -- they're hardcoded to ask for just a username and password. So vendors came up with the idea of appending the token value onto the password, and their middleware (say, a PAM module) splits the provided value into password and token and validates both. EDIT: That's not to say that Schwab is doing it right (in the front-end, seriously???), but just pointing it it's not as uncommon as you think.

jodrellblank 10y ago
RADIUS backend to network equipment as well. Since RADIUS is old, it doesn't have great password hash/encryption support (afaik), so you don't use it over open networks already, and it's well entrenched / widely supported. So have it with no encryption, and the back-end can pull the password and 2FA code apart and verify both of them, for all kinds of systems which have only a username/password prompt for logins.

raybb 10y ago

Wow, how has this not gotten more attention?

Atheros 10y ago
It has. It's just been like that for years.

asafira 10y ago

Are most of these actually still there? The password requirements have changed dramatically in the last 6 months.

jeremyt 10y ago
Well if true, I stand corrected. I have received no communication from Schwab about any changes. I assume that if they had made stronger passwords available, for example, they would notify their customers. I no longer hold any assets at Schwab, but I do poke around every now and then, and it's possible they changed things without me noticing.