5 ms·

it is extremely easy to tell a bank from a tech company: tell if they hash their damn passwords. i'm not even talking salt here, just hashing

• raesene9 9y ago
  if you're thinking of some bank's propensity to ask for specific characters of passwords (rather than the whole thing) meaning they can't have hashed it, it's worth noting that many protect the passwords with symmetric encryption and then store the keys in an HSM to mitigate the risk of unauthorised access.
  • Cyph0n 9y ago
    Unless the HSM is also doing the decryption, the key(s) can still be stolen while in RAM..
    • raesene9 9y ago
      indeed it is. With bank HSMs the encrypted key and characters from the user's password are passed into the HSM and the check is done within the secure hardware, the main system does not get to see the decrypted password.
    • fgonzag 9y ago
      That's the whole point of an HSM... A somewhat tamper resistant device that executes all encryption operations. You give it the hash and a reference to the the key, and it returns the signed data.