21 ms·
Two Canadian banks say accounts compromised: CIBC 40,000 and BMO 50,000
- bearcobra 8y agoThis doesn't surprise me. My BMO credit card has a 6 character password limit. Not minimum, limit!
- xexers 8y agoWow! That seemed so unbelievable I had to google it: "Tangerine, much like BMO, also has a six character limit – numbers only, no letters and no special symbols allowed." https://www.theglobeandmail.com/technology/digital-culture/why-canadas-banks-have-weaker-passwords-than-twitter-or-google/article18325257/ https://www.theglobeandmail.com/technology/digital-culture/w...
- ymlaree 8y agoThis smells plain text password storage..
- gruez 8y agoat 6 characters, does it even matter? even salted + hashed + memory hard kdf isn't going to save you.
- kevin_nisbet 8y agoAgreed, napkin math say's around 3 day's on a single CPU core to test every password.
- clord 8y agoA little bird told me it's because they still use cobol fixed width data and are basically scared to change it. To fix, first they have to finish their rewrite.
- giancarlostoro 8y agoOuch... It saddens me when rewrites are not taken as seriously as they should be... Instead they rather risk people's personal information and finances.
- skissane 8y agoSometimes people resist fixing serious issues with a legacy system, because rewriting the legacy system is seen as preferable to evolving it. But, the rewrite always takes a lot longer than you expect, which can result in a lengthy period in which those issues continue to bite you. Just hire a few good mainframe COBOL programmers (they still exist) and fix the serious issues in the legacy system. Changing a legacy mainframe COBOL system shouldn't be scary. Provided you have qualified staff and the right tools (such as COBOL static analysis tools), it is not inherently more risky than changing a Java or .Net app.
- jeromegv 8y agoWhat I don’t get is that tangerine was originally ING Direct. Which was a new bank that just started in Canada toward the end of 90s or early 2000s. How did they end up with a COBOL system?
- Scoundreller 8y agoING Direct's parent, the dutch ING, fell on hard times during the 2009 recession. So ING sold it off to The Bank of Nova Scotia (BNS). Canada's bank-friendly anti-consumer policy meant that ING Direct had some value, and BNS coughed up the most cash. They were only allowed to use the orange ING branding for a few years, so they changed it to something that was borderline familiar: an orange fruit. BNS probably had to, or chose to, switch ING clients over from the Dutch back-end to their Canadian one.
- jeromegv 8y ago6 character limit was already there during ING Direct years. Possible they were using the old Dutch systems but i find it a tad surprising, they would have needed to set it up from scratch in Canada (as I don’t think anything was stored in Netherlands). So they purposely setup an old-ass system in the 90s. What a shit show
- starky 8y agoIt is because these companies are too lazy to change their systems to separate telephone banking and their online banking.
- kevin_nisbet 8y agoIt's even better than that, to login to the tangerine website, you first enter you're username, and it returns back a picture and phrase you pre-select, before entering you're pin. When showing you the picture and phrase: >Important: If you don't recognize or see your picture and phrase, don't enter your PIN. First check that you entered the correct information. If you're still unsure, call 1-888-SAFE(7233)-304. Anyone care to guess my username, and steal my picture and phrase?
- YZF 8y agoIt's meant to be a very crude protection against entering your PIN on a site pretending to be Tangerine. Yeah, it's pretty dumb.
- dade_ 8y agoAs I recall from opening my account in the 90's the photo feature was always there. It was "forward thinking" at the time, but I can't say they have kept up that pace.
- gruez 8y ago>Not minimum, limit! 1 character passwords allowed?
- 52-6F-62 8y ago[Source: I have a Tangerine account] The password size is fixed at 6 integers. No more, no less.
- brownell 8y agoSo 1 million possible passwords? That's straight-up terrible entropy these days.
- developer2 8y agoIt's actually worse than that. It's fixed 4-digit or 6-digit. Most customers probably use the same 4-digit password for online/telephone banking as they use for their debit card's PIN. I don't care what legacy software the backend is built with; a 4-digit or 6-digit numerical password should frankly be an illegal way for a bank to do business.
- pietroglyph 8y agoWas there ever a reason why a limit like this was a good idea?
- gruez 8y agolegacy systems
- pietroglyph 8y agoI understand that, but I'm looking for something more specific... Hashes aren't length-limited by design; I suppose storage size or database limitations could be an issue, but a 6-character password in ASCII with 1 million users is 6 megabytes.
- deleted 8y ago[deleted]
- mitchty 8y agoHashes aren't limited, but the os might be limited in its implementation. ref: https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/com.ibm.zos.v2r1.ikjc500/ikj2l2_LOGON_command_operands.htm https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/... And I quote: If you are RACF-defined, you must enter the password defined in the RACF® data set as the value for password. The new password specifies the password that is to replace the current password. new_password must be separated from password by a slash(/) and, optionally, one or more standard delimiters (tab, blank, or comma). new_password is 1 to 8 alphanumeric characters long. This operand is ignored for non-RACF defined users. (Printing is suppressed for some types of terminals when you respond to a prompt for a password.) With z/OS® V1R7 or later, the password and new_password can be in mixed case, if your installation has enabled RACF mixed case password support.
- shakna 8y agoSome of these systems originate from the era when a 5mb hard drive was an incredible amount of space, even at enterprise level. They pre-date personal computing.
- ams6110 8y agoMost likely a limit on the underlying Mainframe software that was written in the 1980s.
- mitchty 8y agoDollar to a donut there is a machine with IBM on it backing this up. At a prior life the ultimate reason why "you can type as many characters as you want but only the first 8 matter" came down to passing the login auth to a mainframe which only took 8 characters. Yes in EBCDIC, glad I never had to actually interface with them much, except for having to deploy ftps (ftp with ssl encryption, its an abomination, all due to no sftp on the mainframe at the time).
- sangaya 8y agoIt's also case insensitive !!
- nneonneo 8y agoOn the plus side, I guess this means you aren't using that password on any other sites? :P
- RaceWon 8y agoWith "account security" questions too?
- bitmapbrother 8y agoThe security of these Canadian banks is very weak IMO. CIBC/Simplii, for example, does not support 2FA, has no sign in or transfer email/SMS alerts and their maximum password length, I believe, is 12 characters.
- andrewgjohnson 8y agoI can confirm the 12 character limit. I'm hopeful that will change as part of this.
- Scoundreller 8y agoIt's pervasive in Canadian banking. I have a multi-word job title. Credit card apps will ask: "Enter your occupation, be as descriptive as possible", and I'll hit the limit...
- kjax 8y agoThat beats the heck out of a certain Canadian credit union that has a numerical password with a length limit of 7 digits...
- miguelrochefort 8y agoTangerine's limit is 6.
- ResearchAtPlay 8y agoI can confirm that Scotia Bank, another major Canadian bank, does not support 2FA. This has always bothered me and is especially concerning because Canadian bank accounts can be used to log into Canada's immigration services (CIC). That immigration account is protected only by one more layer of self-selected security questions, after which the intruder potentially has access to a swath of personal data, including passport numbers, and a very detailed personal history section. In my opinion, Canadian banks are way overdue to switch to 2FA.
- verelo 8y agoNor does TD. They don't even do phone notifications of logins. Ironically i signed up with one of the local credit unions in Toronto to take advantage of a high interest savings account for a future tax debt of which I am sitting on the cash for, and found they supported SMS 2FA, and texts when anyone (even me) logged into the account. I wish TD supported this, but then again, as long as their money is backed by the government i don't really care all that much.
- ams6110 8y agoSMS as a 2FA has been discredited, but I suppose it's better than nothing.
- ahelwer 8y agoNope, it's worse. Websites will use it as an authentication method in password-reset workflows, which means hacking your account reduces to intercepting or redirecting text messages (easily accomplished). Rampant cryptocurrency theft over the past year has conclusively demonstrated that SMS-based 2FA is worse than no 2FA at all. The worst offender? Gmail. It uses your phone number for password recovery and is in turn used for password recovery by every other website.
- lotsofpulp 8y agoGmail allows you to use SMS, but does not force you to and gives you other secure options.
- dflock 8y agoAs many people in this thread pointed out: lots/most banks suck ta this. Tiny max length passwords, not 2fa, etc, etc... Are there any Canadian banks which don't suck at this?
- sergers 8y agoI have TD and RBC, both can have complex longer passwords upto 32 character, but not a requirement(atleast when I changed passwords last time). RBC supports finger print auth with their app, and forced security questions.
- diab0lic 8y agoThat 32 character password (on RBC) is case insensitive, unfortunately. I noticed when I logged in with caps lock on (so my cases were inverted) and it worked. =\
- dflock 8y agoActually, I have a new/beta wealthsimple savings account which supports 2fa, etc...
- bonestamp2 8y agoChase is awful too, their passwords aren't case sensitive! If you have an account you can try it right now, type in your password and change the case of a letter and it doesn't make a difference.
- chatmasta 8y agoSo chase is storing passwords in plaintext? Or maybe storing a hash of every combination of case?
- miguelrochefort 8y agoThey probably lowercase passwords before hashing them.
- paulsutter 8y agoI was visiting friends in Canada and I asked “is it true that Canadians don’t lock their doors?” And they responded “oh no, Steve right? Yeah we know a guy, he locks his door”. Always polite, trying to make me feel OK for being from a place where everyone locks their door.
- otoburb 8y agoTorontonians generally lock their doors, as do Vancouverites; so, definitely not all Canadians.
- uiri 8y agoEven in Ottawa, folks generally lock their doors. It is a rural vs urban thing, just like it is in the US.
- dmix 8y agoReality is a bit different in Canada than the one manufactured in Michael Moore films.
- richjdsmith 8y agoI grew up in a town of around 25,000 people. My family never locked its doors. When I moved to Calgary (pop ~1.2mm), I still rarely locked them. I pay for home insurance for a reason.
- deleted 8y ago[deleted]
- ehonda 8y agoI don't know if home insurance covers theft if you don't take basic steps to protect your property (ie locking your door).
- jpambrun 8y agoI live in Montreal and I only make sure the doors are locked at night. In some Montreal neighborhoods, it's common for people just leave their front door open to let the air in, even at street level.
- ficklepickle 8y agoI find CBC has a bad habit of writing corporate fluff pieces. They quote an "expert" from SAS making some vague assurance that their security is good. SAS is a vendor to CIBC[1], but the article fails to mention that conflict of interest. [1] https://www.sas.com/en_ca/events/14/cibc-user-group/home.html https://www.sas.com/en_ca/events/14/cibc-user-group/home.htm...
- zouhair 8y agoThis is why CBC needs to go the BBC's road an go full ad free. The moment you need ads to survive, everything start to work around making advertisers happy.
- monkeynotes 8y agoThis is all good, but as a Canadian I don't want to be forced to buy a TV license to cover the CBC's budget. The UK essentially taxes households with a TV in order to prop up the BBC. When I was growing up in the UK in the early 2000s we didn't watch broadcast TV but we had a TV. A couple of times a govt license officer came over and demanded to be let in the house to inspect our TVs. I loved how my dad stood up to him and told him to basically fuck off.
- vertex-four 8y agoThey’re not Government, they’re employed by a private company contracted by the BBC - they have no special enforcement powers. They have as much right to be in your house as anyone else who turns up at your door i.e. none. The whole TV licensing thing is basically based on the assumption that most people want to follow the law most of the time, which it turns out is a true assumption.
- monkeynotes 8y ago> they have no special enforcement powers I absolutely understand this, the problem at the time the officers were notorious for presenting themselves as if they had a right to enter your house. They would be particularly pushy and work on the assumption that you were going to let them in. Myself, my father, and a friend all experienced this; guy turns up, says he needs to come in to inspect the TV, when you refuse to let him in says he will come back with some kind of legal paperwork to allow him to enter, returns another day hoping someone else opens the door. > The whole TV licensing thing is basically based on the assumption that most people want to follow the law most of the time This is BS, they had infamous adverts on TV saying they would 'catch you out', suspecting the public were stealing the airwaves. https://www.youtube.com/watch?v=EnnaPfAEISo https://www.youtube.com/watch?v=EnnaPfAEISo https://www.youtube.com/watch?v=1Q9CsRRhWQI https://www.youtube.com/watch?v=1Q9CsRRhWQI https://www.youtube.com/watch?v=8NmdUcmLFkw https://www.youtube.com/watch?v=8NmdUcmLFkw ^ Three decades of threatening the public. You tell me that those ads don't make it look as if the officers are gov't employees and have a legal right to inspect your home. In fact, from those ads it makes it look as if they can tell from outside your home that you have broken the law, I am pretty skeptical that any of that would stand up in court as conclusive evidence. Fact is you can legitimately own a TV and not want to watch the BBC, but the BBC insists that owning a TV is essentially the same as wanting to watch BBCTV. </rant>
- deleted 8y ago[deleted]
- flyGuyOnTheSly 8y agoI have to say... I'm not at all surprised about Simplii financial's hacking... I had a PC Financial bank account... and then PC Financial decided to merge their points program with Shopper Drug Mart for some reason... and then I started getting calls from Simplii financial asking me to verify my identity and let's setup my new online bank account... "What?" is all I could think... I had never heard of Simplii financial before... nor was I aware that PC was dissolving/selling their banking arm... I logged into the account once, transferred all of my money out of that account, and logged out forever... The reason I say that I am not surprised that Simplii financial was hacked is because it is hardly even a Bank imho... it was an afterthought.
- giarc 8y agoThey merged points because Loblaws bought Shoppers Drug Mart. Simplii isn't "hardly a bank". It's a bank powered by the same software as CIBC. It's like the Koodo of Telus.
- flyGuyOnTheSly 8y agoI assumed that because I had never heard of them before... that they were just a new name for the old PC Financial banking brand but I could be wrong.
- ageektrapped 8y agoLoblaws sold their interest in PC Financial last year sometime. CIBC took it over.
- richjdsmith 8y agoLovely. One can only hope that other would-be hackers don't start poking the rest of the Canadian Bank's archaic systems or we'll soon see the rest of our not-so-fantastic banks on the front page of HN. For anyone not from Canada, our banks are at least a decade behind the rest of the world in terms of IT - mostly due to strong government protectionism. I was a mortgage broker before changing into IT, and up until the summer of 2015, to submit a mortgage application to Scotiabank, one of big 4, you had to fax it. My buddy who works for Scotia said it wasn't until Q1 2016 before they were able to submit a mortgage application without a fax internally.
- manishsharan 8y ago>>For anyone not from Canada, our banks are at least a decade behind the rest of the world in terms of IT I would not agree with your assertion. I work at the bank with the "Green Sofa " and I can assure you we are very competitive with the US banks as far as technology goes.
- moltar 8y agoRecently tried to login into PC Financial MasterCard online account. And got “your password is too long” error. What? Right! Password length validation on the login form! I called CS and explained that this is impossible as I use a password manager and it worked just not long ago. They assured me that this was always the case and that I’m an idiot for forgetting my password. They sent me to password reset procedure page. The password procedure emails plain text temporary password, which then let’s you pick a new password. When picking a new password, I tried to enter my old password that was too long, just for the heck of it, to see if it’d go thru. Lo and behold, the system answered that I “cannot reuse the same password as previous 6 passwords”. That’s banking-grade security right there.
- randomdata 8y agoIs the validation done using Javascript? I have used a credit union that used to do that until they merged with another credit union and switched to a new system. Password requirements were limited to 0-9, maximum of six digits. However, if you bypassed their client-side validation logic, you could use any password you wanted.
- mikeash 8y agoMy bank has a password length limit of 8 characters. Do they throw up an error? No, they silently truncate it. The cherry on top is that it’s also case insensitive. I stick with them because they’re good otherwise and they make it clear that they take responsibility for any losses due to this nonsense. But holy crap, “bank grade security” is definitely not a positive thing in my eyes.
- p0rks 8y agoI feel the term "bank grade security" used to mean something before we were banking online. "Bank grade security" conjures images of actually having to physically go to your bank and then having your money stored in a vault. Def not the case anymore. There is no cloud, just other people's computers.
- zmpeg 8y agoI have the same PC MasterCard, but in the PC Bank website that was replaced by Simplii, I found that the last character of my password, a period, did not matter to get logged in. I could enter it, or not. It worked either way. Perhaps something similar is happening for you.
- branchless 8y ago> Then later Monday morning, Bank of Montreal revealed that it, too, had received a tip that "fraudsters" had stolen data on up to 50,000 of the bank's customers, "and a threat was made to make it public," BMO spokesperson Paul Gammal said. > In BMO's case, at least, the tipsters were the hackers themselves. > "We took steps immediately when the incident occurred and we are confident that exposures identified related to customer data have been closed off," BMO said. Which "incident"? The theft or the data or being informed they were selling their own ass back to them? The only fraudsters here are the banks, claiming they are secure. Will CIBC and BMO be paying higher interest rates for the elevated risk of banking with them?
- dade_ 8y agoHSBC Canada requires 2FA with a token or their mobile bank app. It also isn't possible to change account contact info, setup new Payees, transfer money to another country, without generating a security code with a token PIN. The contact centre agents are unable to access your account unless you can correctly answer the security questions. This does mean an agent can lock out your account though. It is a pain, but compared with the goofy BMO 6 character passwords, or worse using CIBC at all, it was a welcome change. Legacy systems galore: Scotiabank gave me a debit card once in a branch because I got angry with them and also use mail extensively (though they have a much bigger problem right now), TD Canada Trust and US TD Bank are integrated with mail and fax, and RBC has 3 different domains (not AD) (East, Central and West) and they are completely isolated which can be a nightmare when moving across the country.
- rb808 8y agoHSBC is the only bank I've seen do this properly with a dedicated device. In the US at least you can log on a do a few basic things without the device. https://www.hsbc.com.hk/help/security-centre/device/ https://www.hsbc.com.hk/help/security-centre/device/
- Ntrails 8y agoOver in the UK NationWide started sending out the little pin/auth machines 10-ish years ago (from memory). They're pretty smart about requiring it for anything "unusual" but allowing standard stuff (moving money between my own accounts, paying my usual credit card bill) is fine based purely on password login.
- GordonS 8y agoCan confirm. I also got ones from RBS around the same time.
- mrybczyn 8y agoSure, HSBC gets security right. They just deal with criminals directly rather than indirectly :-) https://www.google.com/search?q=hsbc+criminal+investigation https://www.google.com/search?q=hsbc+criminal+investigation
- mFixman 8y agoI have an account in BMO that I'm in the process of closing. Besides kicking myself for opening an account in a 6-digit password site, what should I keep in mind regarding my compromised data?