46 ms·

Banks, Arbitrary Password Restrictions and Why They Don't Matter

• shanecoin 7y ago
  I would argue that this is not just banks but a number of different services. This entire Github repository [1] and this Twitter account [2] are dedicated to sites with dumb password rules. Passwords are not meant for humans. Here is a link to a hackernews thread discussing the worst of the requirements in the repository is here [3]. [1] https://github.com/dumb-password-rules/dumb-password-rules https://github.com/dumb-password-rules/dumb-password-rules [2] https://twitter.com/dumb_pw_rules https://twitter.com/dumb_pw_rules [3] https://news.ycombinator.com/item?id=20890381 https://news.ycombinator.com/item?id=20890381
  • pingyong 7y ago
    The PayPal section doesn't mention that they have a 20 character limit too. I honestly wonder what kind of buffoons are in charge of making this shit up at multi-million dollar companies.
• mquander 7y ago
  He turned to me and said, "Do you really think the only thing the bank does to log people on is to check the username and password?" Banks are way more sophisticated than this and it goes well beyond merely string-matching credentials; there's all sorts of other environment, behavioural and heuristic patterns used to establish legitimacy. You won't ever see a bank telling you how they do it, but those "hidden security features" make a significant contribution to the bank's security posture. Their response to having visible security that sucks is to say that they also have a lot of super complicated invisible security which is actually really good? Why am I supposed to believe that? Their invisible security probably sucks even more.
  • Someone1234 7y ago
    It is likely just a GeoIP database and some basic user agent heuristics. I've worked at places that claimed stuff like this in public, and when you got to see behind the curtain it was a huge disappointment. The people who really spend big bucks on this stuff are the ad-networks. Click-fraud is hugely costly to them, so determining "real" users (and the quality/type of user) is huge multi-billion dollar stuff. Creepy, but it works.
    • pbhjpbhj 7y ago
      Surely the bank giving the wrong people their money is a huge problem too? I know they mitigate it by trying to claim it's a customer's money and not their responsibility, but that doesn't always work for them.
      • AnIdiotOnTheNet 7y ago
        It works enough. They've managed to push the term "identity theft" into the public consciousness as a description of the problem, when the real problem is that they can't be bothered to actually identify people.
    • thaumasiotes 7y ago
      It's considerably better than that. Some examples: The first time I went to China, I tried to pay for something with a debit card and my account got locked. I had to call the bank to OK it. Subsequently, being in China has never been a problem, though I don't bother to tell the bank where I am at any given time. On the other hand, after a trip to Georgia (the US state), my card information was apparently skimmed and used to make a fraudulent purchase, in Georgia, a week later. My legitimate purchases on the trip triggered no alarms, but the fraudulent one triggered a phone call to me alerting me that the bank had detected suspicious behavior on my account. I'm still amazed they could tell the difference.
      • seanmcdirmid 7y ago
        My bank has SMS alerts, I can ok a suspicious transaction just by saying Y. I also chose HSBC because they have branches in China, otherwise they are not a great bank.
  • tialaramex 7y ago
    I agree, Troy is way too gullible here. > Do you really think the only thing the bank does to log people on is to check the username and password? Yes. I assure you that when bad guys with your username and password log in and steal all your money the bank _won't_ say: "Doh, our sophisticated environment, behavioural and heuristic patterns used to establish legitimacy let you down this time. We'll pay for this" No, they'll say it is your fault because the bad guys had your username and password. And that's all you need to know.
    • VBprogrammer 7y ago
      I'm inclined to agree. I was checking my bank account on my phone yesterday and the office Wifi was having an off day. So I disconnected the wifi and proceeded to try to login over 4g. I got locked out of my account for 10 minutes because that is suspicious. After checking my account I couldn't find a payment I was expecting to see so I opened my account on my laptop and got locked out for another 10 minutes. Sounds like the dumbest IP checking to me, not some super clever heuristic based check.
      • heavenlyblue 7y ago
        It's that assumption, literally: if the attacker had managed to steal your session information from the browser, then they would not be able to use it since they would also need to share my IP. In real life if the attacker is capable of stealing my session credentials the chance of them _not_ being able to tunnel through my local network is infinitesimal.
        • VBprogrammer 7y ago
          The thing is though, what they seemed to object to was trying to login (not using the same session cookie) across different IP addresses. At least that was the case when I opened the site on my laptop. Maybe my phone did login on the dodgy wifi and then when I reconnected via the 4g it tried to use that session, perhaps causing my account to be flagged. I'm not really convinced though. It clearly makes sense to tie the session to the IP address but the 10 minute delay doesn't make much sense to me.
  • pjc50 7y ago
    The corollary to this is that a user can fix a "wrong password" error, but if they're locked out by the invisible security, they can do nothing. I'm not looking forward to the mandatory phone auth on "3d secure": https://www.sagepay.co.uk/support/12/36/3d-secure-explained https://www.sagepay.co.uk/support/12/36/3d-secure-explained
    • FussyZeus 7y ago
      I was coming here to say the same thing. This might explain why every time I try and login to and manage our Costco Citi card (which is in the wife's name) I constantly run into issues with the password in our shared 1Password vault not working. It's gotten so obnoxious she manages it entirely now via the mobile app, because every time I would try and make payments it would lock the stupid thing.
  • kryogen1c 7y ago
    >Their response to having visible security that sucks seems like you missed the whole point of the article - their security doesn't suck. EDIT: as reply points out below, not bits of entopy, just possible combinations. ORIGINAL: 3 trys - thats it. theres no account autounlock. 5 lower case letters is ~12 million bits of entropy, and thats if you even know the username which, the article points out, you often dont. furthermore, even if i accepted your claim that this "visible security" was bad, the "invisible security" is well established. any reputable bank will flag your account for any number of reasons. ive had cards (correctly) locked for <$1 charge at an air pump a few miles away. >Why am I supposed to believe that? again, as the article says, "Banks like ING will give you your money back". they have skin in the game and will refund your fraudulent charges.
    • zAy0LfpBZLC8mAC 7y ago
      > 3 trys - thats it. Until the users logs in, then you have another two tries. Until the users logs in, then you have another two tries. Well, and so on, ad infinitum. > 5 lower case letters is ~12 million bits of entropy, That's more like 23.5 bits, which, as far as I know, is quite a bit less than 12000000. > again, as the article says, "Banks like ING will give you your money back". they have skin in the game and will refund your fraudulent charges. So, if everything looks like you authorized a transaction, they'll give you your money back because you said so? And you seriously believe that?
      • kryogen1c 7y ago
        >> 5 lower case letters is ~12 million bits of entropy, >That's more like 23.5 bits, which, as far as I know, is quite a bit less than 12000000. woops! youre totally right. added an edit. >ad infinitum. this is not true. banks take action and will not give you probably any more than 2 or 3 sets of lockouts before taking action. >So, if everything looks like you authorized a transaction, they'll give you your money back because you said so? And you seriously believe that? You must not be from the US. To my knowledge, most banks will refund fraudulent purchases. in addition to being believable at face value, I have also personally had fraud charges reversed.
  • ohduran 7y ago
    Like "military encryption" and buzzwords like RSA, which leads me to believe that banks do just the bare minimum that some consultant has told them to do...
  • cygned 7y ago
    I can’t tell you why, but I know some of the anti-measures bank use and I can assure you that they are pretty sophisticated. However, all I have seen are security efforts to secure the network, not the banking interface of customers - which means, if someone has your name and passcode, they can access your account online. I bet they have something like IP address origin checks and nothing more.
    • nomagicbullet 7y ago
      > I can’t tell you why, but ...
  • doctorpangloss 7y ago
    Yeah it would be great if Bank of America just worked with Safari and uBlock Origin on with my username and password, and it didn't have these moronic "patterns."
  • steventhedev 7y ago
    > Why am I supposed to believe that? Because it's required by law, at least in the US, UK, and most of the EU. The quality varies somewhat, but the main goal is less to prevent fraud than to detect it after the fact. Basically every single bit of information your computer is willing to send will be recorded. That includes request headers at a minimum (if you've disabled JS) and quite a bit more if you do have it enabled. Try a packet capture when you open your bank account next time to see just how much they transfer out of your computer. Source: used to work on one such product
    • berdon 7y ago
      What laws?
      • steventhedev 7y ago
        I worked dev (hence the username) and left the company more than 5 years ago, so I don't remember the exact regulations. I do remember it was a big deal towards end of 2012, so you're probably looking for something from around 2008 with a final enforcement date of 2012. I'll update if I remember the name.
        • xmodem 7y ago
          There was a bunch of stuff to do with this in the first payment service directive, most of which was enforced around 2012-2013 https://en.wikipedia.org/wiki/Payment_Services_Directive https://en.wikipedia.org/wiki/Payment_Services_Directive PSD2 has requirements on "strong customer authentication" basically requiring 2-factor, that were meant to come into force on Saturday the 14th of September just passed, but ended up being delayed at the last minute in most countries.
    • TeMPOraL 7y ago
      It would be interesting to see how this squares with GDPR, the purpose of the latter being to minimize recording of what your computer is willing to send.
  • berdon 7y ago
    I've had the opportunity to chat with many ex-bank developers and based on those discussions I'm as positive as I can be, without my own personal experience, that this is assuredly utter garbage. The last two I've spoken with had read-only access to _everything_. The entire company did.
    • jen729w 7y ago
      I’ve worked at 2 of the 4 major banks here in Australia and I’m calling bull on that last statement. The entire company had read-only access to everything? Yeah nah. Who put the Siebel client on Janice the HR lady’s laptop? Who created an account on the mainframe for Barry the bloke who re-stocks the milk in the fridge? You get my point.
      • cyphar 7y ago
        I think they meant that the last two ex-employees they spoke to had read-only access to everything, not that every employee at a given bank had access to everything.
      • berdon 7y ago
        I was a bit exaggerative - the entire "development" arm of the bank had read only access to all customer financial data. One of the devs was a customer and pulled up all of his information.
  • PretzelFisch 7y ago
    It's questionable when you can turn bank passwords over to a random third party to check/verify your account information or import the data into another system.
  • 99052882514569 7y ago
    "Why am I supposed to believe that?" Because if someone gets in, they're going to refund you.
  • scrumper 7y ago
    Well here's some of it. This is what ublock origin has to say about us.hsbc.com: google.com adsrvr.org amazon-adsystem.com appdynamics.com bing.com demdex.net doubleclick.net facebook.com googleusercontent.com gstatic.com hsbc.com linkedin.com liveperson.net lpsnmedia.net omtrdc.net tiqcdn.com yahoo.com youtube.com ytimg.com Plenty of behavioral stuff in there!
    • giancarlostoro 7y ago
      They wouldn't put that in the front-end allowing you to block it. It's all in the back-end using third-party services such as Guardian Analytics. Dislcaimer: I briefly worked as a software consultant in the finance industry, that is one of (I'm sure) many out there. You don't want to expose third parties you use for parts of your online banking process. I assume bigger banks homebrew it all.
      • shadowprofile77 7y ago
        But why would this really be? Are they actually attempting to harvest specific user data for HSBC account holder X from all these sources? (something I sure as hell wouldn't want my leaky bank to do no matter what kind of security it promises) Or are these just links for the sake of typical bigcorp bullshit ad tracking attempts.. Any ideas?
        • scrumper 7y ago
          Probably the latter in fairness. But presumably the data from those trackers feeds into the hidden backend heuristics the parent commenter mentioned.
          • shadowprofile77 7y ago
            Yes but if one has many of these disabled or logged out (the social media-type pages in particular) I imagine they couldn't get much for the sake of heuristics data collection anyhow,or if say you log in from a device where none of these accounts are also opened. I can't imagine Facebook openly letting a third party banking site or app scrape up its precious specific user data without first paying for it in "anonymized" form, ditto for Google, so how might that work if the bank was attempting that?
  • rkagerer 7y ago
    I've done work for a few major banks and seen their back-ends. Most of the products and tools they use in support of security are purchased from 3rd party vendors, and some of them aren't bad. Where I've seen it break down is in practice, where you end up with a bunch of compromises that boil down to "lowest common denominator". e.g. Banks are buying each other up all the time. After a few dozen acquisitions you end up with a giant hodgepodge of diverse systems not designed to work together, but need to integrate them. Username and password is common to all, so you wind up with raw dumps to synchronize credentials. (That's less common now that most vendors have adopted better practices like password hashing, etc. but it wasn't so uncommon back in my day) I'm not surprised at the character limits. It simply means there's at least one legacy system somewhere that can't accommodate more. It's not necessarily tied to a plaintext database field as Troy suggests; it could simply be a validation in some line of custom reporting code a programmer put in two decades ago based on ancient requirements devised long before current-day practices. Or more simply, bank IT themselves may be unsure what their real limit is at a given point in time, and chose to go with something "safe". I'm not denying banks need to step up their game, after all it's nearly 2020. But personally I think the reason it won't matter is most of them won't be around long enough - they're in for a world of painful disruption from the likes of Stripe, Apple, Google, cryptocurrencies, Libra-like instruments, peer-to-peer services and micropayments, etc. and who-knows-what other big innovations about to be invented by geniuses from areas of the world presently starved for financial services.
    • astine 7y ago
      "I'm not denying banks need to step up their game, after all it's nearly 2020. But personally I think the reason it won't matter is most of them won't be around long enough - they're in for a world of painful disruption from the likes of Stripe, Apple, Google, cryptocurrencies, Libra-like instruments, peer-to-peer services and micropayments, etc. and who-knows-what other big innovations about to be invented by geniuses from areas of the world presently starved for financial services." I'd be surprised if these services actually disrupted the banking industry. Banks are heavily regulated, and with reason. The moment any service starts to step onto bank turf, they're going be subject to the same regulations and will have to effectively become a bank as a result. What's more, these services don't address the social role that banks play where they enable governments and large business to function by loaning them money. Or the economic control function that banks play. Banks will remain in existence for generations to come.
  • JumpCrisscross 7y ago
    > Why am I supposed to believe that? You aren’t. You trust that if your money is stolen in a hack, the bank is liable for your losses.
    • criddell 7y ago
      Exactly! We had some money fraudulently withdrawn from our Wells Fargo checking account and though we got it back, I had a bunch of questions about bank security. My bank manager arranged a phone call from somebody on the inside to me. I pressed her about their password length restriction saying that as long as they are hashing the password, length doesn't practically matter. The fact that length is limited to a small number of characters makes me think they are storing the clear password in a database. The response was basically don't worry about it because you aren't responsible for fraud.
      • nybble41 7y ago
        > The response was basically don't worry about it because you aren't responsible for fraud. That's assuming you can prove it. The banks' poor authentication practices certainly don't help on that front. If their own systems don't flag the transaction as fraudulent then it becomes nothing more than your word against theirs. And storing cleartext passwords is a risk to the user in the event of a breach regardless of their liability, or lack thereof, for fraudulent activity in their account. (Yeah, each password should be a unique, random string used only for that account—in theory. It rarely works out that way in practice.) Personally I'd rather they implemented standard strong authentication mechanisms and backed off a bit on the data-mining and general paranoia about atypical transactions. Chip+PIN cards are a good start on this but they're still far from universal (especially the PIN part) and don't work at all for online payments. The card should be a proper HSM with standardized interfaces for PCs and mobile devices, and the PIN should be both mandatory for every transaction and randomly assigned.
        • criddell 7y ago
          > That's assuming you can prove it. Once you tell them some transaction wasn't authorized, it's up to them to prove otherwise. All the suggestions you make are great if your goal is to minimize fraud. If you are trying to maximize profit then you don't tighten security if the cost to do so exceeds losses due to fraud.
  • triceratops 7y ago
    Not always. See https://www.pindrop.com https://www.pindrop.com
  • dukoid 7y ago
    Don't get me started on their "invisible security" on credit card transactions....
  • flurdy 7y ago
    I think Troy has too much trust in financial institutions, or rather their staff that he encountered. I have worked for and with several banks and financial institutions, and my impression is that this industry takes security theatre very seriously whilst quite slack and outdated on actual security. There were a lot of ivory tower architecture (and architects) that imposed random restrictions but full of gaps and workarounds, and not very impressive once you saw past the gimics. Unfortunately, their own staff and management mostly bought into this theatre so I can't see it improving very much. Some parts were done well and useful, but a lot was just outdated and ineffective, and just restrictive. But they have so many layers, so hacking a bank is hard, and various delays so that they can recover and recompensate you before you know it if there even was some fraud or other discrepancies. Though there were some niches of clever heuristics and analysis but not much real-time, so my I don't buy the "Do you really think the only thing the bank does to log people on is to check the username and password?". For most that is nearly the only thing they do. Last time I worked for a financial institution they were starting to introduce some useful user and device fingerprinting anomaly detections so I hope it has gotten better...
  • rednerrus 7y ago
    I'm sure that Equifax used these security features.
    • fortenforge 7y ago
      How on earth is that relevant? Equifax's breach had nothing to do with password authentication whatsoever.
  • FabHK 7y ago
    > there's all sorts of other environment, behavioural and heuristic patterns used to establish legitimacy. Here's what annoys me: These "environment, behavioural and heuristic patterns" check for cookies, IP/location, typing speed or so, don't they. Which means, that if I (for enhanced privacy and security) frequently clear my cookies and habitually use a VPN and/or travel a lot and use a password manager and copy/paste the password, then I'm flagged as suspicious and just DOSed myself. Thank you very much. I must admit though that most of the banks I use are reasonably good with that. Paypal, however, is just a total pain in the ass: basically every time I try to use it, it concludes that I'm brute forcing myself and blocks me.
  • Spooky23 7y ago
    Seriously. They do the bare minimum requirement of their regulatory regime and other insurance requirements in most cases.
• kardos 7y ago
  This 'hidden security features' explanation sounds a bit like security by obscurity. Mouse movement fingerprinting? Browser fingerprinting? Locking people out when they get a new laptop doesn't sound like a good time
  • mobjack 7y ago
    It likely means they use reCAPTCHA. They could be doing 2FA when someone logs in with a new device too.
• londons_explore 7y ago
  If someone guesses the 2 numeric digits necessary to gain telephone access to my pension fund, and they then transfer out the $10M value to the cayman islands, will they really give me back the money? Would I have any chance in court? - proving it wasn't me is near impossible. Yet this pension company has millions of customers, and presumably isn't seeing widespread fraud. How come?
  • patio11 7y ago
    Because you're evaluating the effectiveness of one control in isolation, whereas the pension fund has a lot of controls, including e.g. an operational team which knows that wiring money to the Caymans is intrinsically high risk, a written procedure that they'll follow for high risk transfers specifically to papertrail up evidence in the event it is contested, a legal environment which will put the burden of proof on them rather than you if they did something that self-evidently stupid, the medallion guarantee program and associated regulation, etc etc. Fraud happens. Financial institutions spend a lot of money defanging it; they also, when push comes to shove, have budgets for it.
    • whitepoplar 7y ago
      I'm curious--how big are those budgets?
      • throwaway201606 7y ago
        For the really large banks: $XYYMM (i.e. hundreds of million dollars aka the cost of doing business) across all lines of business. All this is mostly public info as it has to go into financials, you can find it under "Operational Losses" for any public bank (Note that "Operational Losses" are not the same as "Operating Losses"). A sample multi-year summary can be found here from an industry body in Europe for losses for debit. (losses are demonimated in Euro):look at page 7 under the last column for the rows "Retail Banking". Important to note that credit ops losses are an order (or maybe two) of maginitude higher. https://managingrisktogether.orx.org/sites/default/files/downloads/2018/09/annualbankinglossreport2018-printversion.pdf https://managingrisktogether.orx.org/sites/default/files/dow...
• zAy0LfpBZLC8mAC 7y ago
  Sorry, but that article is just dumb. For one, obviously, the possible existence of other security mechanisms is exactly no reason for intentionally breaking password security. Either you store passwords as plain text, in which case you have just failed, or you are storing a hash, in which case there is no cost to doing the right thing and accepting arbitrarily long passwords. There is no way to start with "we have other security mechanisms in place" and end with "therefore, we should weaken password security". And if an organisation is incapable of understanding that trivial piece of logic, I have very little hope for their supposed magic security solution. But even worse: The idea that locking users out after so many failed attempts is a security mechanism. When a small bandwidth of unauthenticated requests can disable a critical service, that is known as a denial of service vulnerability and not a security mechanism. If you have proper passwords, locking users out is completely useless for security, but it's still a DoS vulnerability. A brute force attack will not crack a 128 bit random password, no matter the rate at which it is tried. And while non-public user IDs can help mitigate that risk, it is not at all a given that banks don't use essentially public account numbers as user names, even ones that have 6-digit password limits. Plus, the user ID at that point effectively becomes part of the password, just that it's a password that you can't change, which isn't exactly brilliant either. And finally: It's quite a failure at assessing attack scenarios if you think that user lockout actually solves a problem. Your typical bank has a failure counter per account. A failure counter that is reset on every successful login. So, the real number of attempts an attacker could make is the number of attempts you have before lockout minus one, multiplied by the number of successful logins by the customer. An attacker might not necessarily be able to know very well when the user has logged into their bank account, which sure will limit the exploitability somewhat, but then, that very much depends on the circumstances. If you know someone pulls their transactions every 15 minutes, say (especially a business, which might even leak the time they pull transactions by sending payment receipts in response, for example), then you might very reliably be able to make 8 guesses per hour, or ~ 70000 per year, without causing lockout. If you instead want to target the general public, you might also just use a bot net to attempt login into accounts only occasionally, risking some lockout, but statistically compromising a certain number of accounts over time. And all of that when proper passwords do solve all of those problems perfectly reliably. Oh, yes, and the idea that some banks will give you your money back? Seriously? Now, if that isn't a failure at assessing risks, I don't know what is. Who seriously believes that banks will give you your money back on your word that you didn't authorize some transaction? Of course, they won't, they'd be wide open to fraud if they did. If the attacker is good enough at making it seem like the customer authorized the fraudulent transaction, obviously, the customer won't get back a cent. Those claims by banks are marketing bordering on fraud, and obviously not something anyone claiming to be an expert in security should just trust to be something you can rely on.
• hyperman1 7y ago
  The 5 number 3 tries bank does not seem very secure: It is (at least in my country) very easy to guess valid acount numbers: They are incrementally numbered + have a checksum. So while 1 account of a 5 number 3 tries bank is safe, attacking all of them in volume is not: With N numbers, T tries, A accounts, the chance of guessing at least 1 account is pow(1-T/pow(10,N),A) 5 numbers 3 tries means a chance of 0.9997 of being locked out of 1 account. For A=100 000 accounts, the chance is 0.049, so more than 95% chance you guessed one account right. For A=1 000 000, you're almost certain. And that's the dumbest possible way. Try guessing with the most common password like 12345, take only 1 try each month so people unknowingly reset the account number when doing payments, and use a botnet to spread the load over tons of IP adresses and randomize the numbers.
  • SamBam 7y ago
    Exactly. The math is not in their favor at all if the attacker is able to work out or guess numerous account numbers.
    • bscphil 7y ago
      I think this is exactly right. My bank has predictable account numbers too, and if they had one of these 4 or 5 digit password limitations, they would be a very ripe target for someone using a botnet to just go through all the accounts. The risk isn't that someone will target you personally, the risk is that someone will happen to hit you while attempting the profitable activity of hacking every account. (Plus, at least with a bank, if they manage to hack in and steal the database, one of the most profitable ways to use it would just be to log in and steal money. No effective hashing on a 5 char password.) I also completely distrust the "advanced security measures" claim. I have no trouble logging into my bank via curl, including from remote IP addresses. (They finally rolled out 2FA, but I can still type the text code into my script.) A couple years ago I discovered a number of vulnerabilities in their account site, too (including some many years old software with vulnerabilities with a CVSS of 10). After I reported this to them, the response from the guy who worked there was basically "Yeah, that's from the crappy vendor who supplies us with this software. Please don't say anything about this because we're replacing it with a new in-house backend in a couple months."
• mnm1 7y ago
  Good points, however this one is wrong. > Banks typically use customer registration numbers as opposed to user-chosen usernames or email addresses so there goes the value in credential stuffing lists. I've had accounts at most of the major US banks and I don't think I can think of a single one that did this. Almost every single bank allows the user to select a username or occasionally uses email for login. This is not a good argument for Chase, Citi, Amex, Discover, Capital One, Barclays, and a whole bunch more I can't think of off the top of my head.
• paulpauper 7y ago
  the money is in hacking bitcoin/crypto-related stuff anyway. Get the 12 words and there is nothing than can be done to recover the $ and nearly untraceable. hacking banks is overrated unless you can not onyl produce a facsimile of the victim including ID and other docs but also get past all the restrictions and then not be found and arrested in the process.
• viraptor 7y ago
  > Do you really think the only thing the bank does to log people on is to check the username and password? Yes, I do think that. I automated some banking functions for myself and the last 4 retail banks worked just fine when accessed with curl, or headless chrome. I didn't even change the user agent for curl and used no delay between requests. Not only do they trust credentials, there are no extra checks in most cases. This is experience from UK and Oz. Lloyds, CommBank, ANZ, ING. ING is actually the "hardest" one. Their 4-digit scrambled keypad varies colours slightly so it requires closest-match comparison to known samples. That was like 3 extra lines of code.
  • chopin 7y ago
    I even believe this is a good thing. Just recently I canceled an account (not a bank) because they would only let me in with reCaptcha enabled.
  • throwaway201606 7y ago
    Access control is not on a binary 'yes-or-no ' decision on a per single-signal basis. It is usually a weighted result of multiple signals. For example, it may look at say 20 factors and have a failure threshold of 15 passed. Most of the signals are evaluated server-side. By design, some signals used are picked such that customer convenience, among other things, is not affected (e.g. the account holder data pull automation that you describe in your example ). Examples of signals include timezone, time of login vs. past logins, hardware profiling (OS, screen resolution, IP, ISP, VPN vs. no VPN - based on known VPN server lists ) etc. I agree that not all banks are doing this but the more sophisticated ones are (quite a few of them). Point here is curl or headless browsers working is not evidence of only account and password being checked.
    • zAy0LfpBZLC8mAC 7y ago
      Or in short: It's an untestable claim. No possible result of any experiment will count as evidence that there isn't a magic security system in place that will protect you but that through its magic figured out that your legitimate access was legitimate.
• pridkett 7y ago
  The challenge is that if a system only offers a four or a five number passcode, you can still attack accounts by just guessing passcodes for account names/numbers. This is addressed a little bit by pointing out that it’s sometimes not easy to enumerate accounts - but if you’re malicious and have purchased a list of compromised accounts, you could then pound the system from a botnet even after the passwords have been changed. In this case you’re not concerned about a _specific_ account, but rather you’re concerned about _any_ account. And with a 4 or 5 number passphrase, you’d get hit pretty quickly.
  • philliphaydon 7y ago
    If you knew the bank and the account, you could assume that people login to their account atleast once a month. So every month you could try a combination. Known passcodes could be tried first. If a dump also has the person Birthday then their birth year is a good Guess for a 4 digit pass code. 2 failed attempts reset when the user succeeds their login during the month. There’s so many things people could do. Limiting passwords is a bad idea :/
• htfu 7y ago
  I cannot believe ANY banks are using passwords at all in this day and age. Reading discussions like this makes my brain hurt - even a decade and a half back we were on chip and pin card readers for login/signing verification, now since a long time back there's a universal app-based 2fa equivalent (Mobile BankID). That's not the case for "my bank(s)" but all banks here. I wonder what makes the US/UK/AUS so special? It's all incredibly alien.
  • jbarberu 7y ago
    Moving from a country with Mobile BankID to the US, all I can speculate is that it's not a big enough problem for the banks to make the investment. Similar to the healthcare system keeping the status quo is "cheaper" until you're one of the unlucky ones...
• mark-r 7y ago
  I haven't been able to log into my bank for something like 10 years, because their password restrictions made me pick a password I couldn't remember.
• cm2187 7y ago
  Amazon really understands what security means. When it does 2FA, sends you a unique code by email, it disables the option to paste that code back into the login form, you have to type it. You know you are dealing with really competent people when you see that!
  • jjoonathan 7y ago
    Ah, yes, messing with paste, the ultimate in security. /s
    • darkhelmet 7y ago
      Hence wonderful addons like "Don't f*ck with paste" to fix such stupidity.
      • jjoonathan 7y ago
        I've got it installed, and it's good, but the world built a better idiot: sites that use flash, implement their own key event processing, etc.
    • throwaway744678 7y ago
      They could go one step further, and send the code as an image (with a link to read it aloud, for blind users, of course)
• exabrial 7y ago
  My favorite is "locking the account after x number of password attempts". Ever want to annoy the hell out of someone? Try their username or email a bunch of times and lock them out of their accounts. Bonus points if it's one of those super duper ultra secure banks that does password resets via snail mail. /s [I don't condone doxing anyone. My point is that an attacker should not be able to modify the state of a system he's unauthorized to access]
  • SamBam 7y ago
    That seems to be the least objectionable to me. You need to have some protection against brute-forcing. Whether it's limiting the rate of guessing or whatever, the attacker is still "modifying the state of a system." Indeed, that's a weird rule. When someone stole my credit card number and ran up charges, my bank called me to verify them. How was that not "modifying the state of a system?"
    • nybble41 7y ago
      > You need to have some protection against brute-forcing. Whether it's limiting the rate of guessing or whatever, the attacker is still "modifying the state of a system." You could just make brute-force searches unproductive, for example by requiring a hardware security key or client certificate rather than a mere password or PIN. Good luck brute-forcing a 128+-bit random secret. > When someone stole my credit card number and ran up charges, my bank called me to verify them. How was that not "modifying the state of a system?" The state of the system was modified when an unauthenticated (never mind unauthorized) individual managed to run up charges on your account using only your credit-card number—which is "sensitive" information but not actually secret. That should not have been permitted in the first place. If the rule had been applied properly then this remedial step would not have been necessary.
    • zAy0LfpBZLC8mAC 7y ago
      > You need to have some protection against brute-forcing. Yes, that protection is called "password". > Whether it's limiting the rate of guessing or whatever, the attacker is still "modifying the state of a system." Which is why you should not limit the rate of guessing (or at least offer that option--limiting the rate of guessing does help users who use terrible passwords, after all). > Indeed, that's a weird rule. When someone stole my credit card number and ran up charges, my bank called me to verify them. How was that not "modifying the state of a system?" Which is exactly why that shouldn't be a thing. Being able to pay with a semi-public number is just stupid. You should have to authenticate using a strong password, and "stealing credit card numbers" simply wouldn't be a thing anymore.
• PhasmaFelis 7y ago
  > That very first tweet touched on the first reason why it doesn't matter: banks aggressively lock out accounts being brute forced. Until a hacker steals the salted password database and brute forces it as much as they like. A truly strong password is secure even when the attacker has the salted version. (Anyone who tells you that it's completely impossible for a hacker to ever get their password file is lying either to you or to themselves.)
• Thriptic 7y ago
  What's odd to me about this post and all of the responses in this thread so far is that everyone is only thinking about password length as a way to defend against online bruting attempts when in reality long passwords mostly serve to protect against offline bruting attempts. The reason you don't want 6 or 8 character passwords is that when your password hashes get dumped it's a lot easier to crack them.
  • throwaway201606 7y ago
    "What's odd to me about this post and all of the responses in this thread so far is that everyone is only thinking about password length as a way to defend against online bruting attempts when in reality long passwords mostly serve to protect against offline bruting attempts. The reason you don't want 6 or 8 character passwords is that when your password hashes get dumped it's a lot easier to crack them." This is: i) not accurate and ii) bad info Password hash dumps are worthless if the password hashing scheme used is i)crypto-hashing based and ii) uses salt. 6-8 char passwords are not an issue under this scenario. Current password management best practice is to use both standard crypto-hashing algorithms and salt. https://en.wikipedia.org/wiki/Salt_(cryptography) https://en.wikipedia.org/wiki/Salt_(cryptography) Almost all platforms use standardized crypto-hashing packages that come as standard libraries in the language these days and those require salt. Further, almost all banks will all use these packages. This is the reason you do not see rainbow tables these days, they are worthless in face of almost any current acceptable crypto-hashing implementation ... assuming one does break rule #1 of crypto and try to roll their own crypto ... https://security.stackexchange.com/questions/18197/why-shouldnt-we-roll-our-own https://security.stackexchange.com/questions/18197/why-shoul... https://www.schneier.com/blog/archives/2015/05/amateurs_produc.html https://www.schneier.com/blog/archives/2015/05/amateurs_prod... .. ad nauseam Salting also has the additional benefit of making brute-forcing magnitudes of difficulty harder. This is because salting rules can be implement that always add non-standard chars.. https://en.wikipedia.org/wiki/Salt_(cryptography)#Common_mistakes https://en.wikipedia.org/wiki/Salt_(cryptography)#Common_mis... As others have said, the 6-8 chars limits are are a function of legacy system somewhere in the application chain (online banking is never a single platform, it is usually a front-end that talks to a standard backend that tellers, operations etc also access, usually some type of greenscreen app - which is where the password hashes end up).
• shin_lao 7y ago
  When the accounts of our company started to be beyond the low 6 figures, we got upgraded by our bank to a different online banking system with a smartcard and a keypad for strong 2FA. Our admin team is informed every time someone logs in the system, and wiring money is a 2 phase process. If a transaction is unusual, the bank usually contacts us. So yes, I do think banks have additional protection measures, it's just not worth it for smaller amounts where the insurance will just cover it.
• RHSeeger 7y ago
  >> Hey [bank], does that 16 character limit mean you've got a varchar(16) column somewhere and you're storing passwords as plain text? > As much as I don't believe that's the case in any modern bank of significance, it's definitely not a good look. Inevitably the root cause in situations like this is "legacy" - there's some great hulking back-end banking solution the modern front-end needs to play nice with and the decisions of yesteryear are bubbling up to the surface. It's a reason, granted, but it's not a very good one for any organisation willing to make an investment to evolve things. But the only reason that "legacy" system would have a limit is because it's storing your password. So > I don't believe that's the case in any modern bank of significance It _is_ the case. It may not be the case in their most recent systems, but a chain is only as strong as it's weakest link. You can be hashing/salting the user's password and locking it behind a vault door to make sure noone can access it. But if you _also_ keep a copy of the password in plain text on a piece of paper taped to the outside door, the vault copy doesn't protect it.
• meuk 7y ago
  My bank allows arbitrary length, but enforces certain special characters while disallowing others. Which means I can't use the (long and secure) password and have to write it down. Not sure what they hope to accomplish.
• ufmace 7y ago
  I think basically everyone in this thread is looking at this all wrong. Banks don't have a ton of fancy hidden security gating the login itself most of the time. Trying to build a digital Ft. Knox in front of the login page and then paying no attention to what the users do after they login is the wrong way to go about securing these types of accounts. I'm pretty sure they have much more security around detecting and blocking suspicious behaviors after you've logged in, like adding new payees on bill pay systems, requesting transfers of large amounts of money to random accounts, particularly overseas, etc. I also argue that banks have much, much better security than anything most of us have ever touched, because they handle billions of dollars moving around routinely and manage not to lose it. Meanwhile, half of the internet can't manage not to lose the email addresses of everyone who signed up for their cat picture website. If they're trying that hard to steal something of little value like that, how hard to you think people are trying to steal the billions of dollars that banks handle?
  • Radle 7y ago
    " I also argue that banks have much, much better security than anything most of us have ever touched, because they handle billions of dollars moving around routinely and manage not to lose it. Meanwhile, half of the internet can't manage not to lose the email addresses of everyone who signed up for their cat picture website. If they're trying that hard to steal something of little value like that, how hard to you think people are trying to steal the billions of dollars that banks handle?" Exactly this is the reason why I don't think Troy is being gullible here.
    • lawn 7y ago
      There's a logical fallacy here that I don't know the name of: "Because it's so important, surely they must be competent." Which does not follow.
      • ufmace 7y ago
        I do not argue that they're competent because they're important. I argue that they are competent because there is a multi-billion dollar pile of cash that they're guarding. If they aren't competent, how come nobody has stolen it all yet? Look at the efforts spent hacking Bitcoin exchanges and identified large holders. Lots and lots of money being taken there. Look at the efforts made to hack much less important things. How come no big banks have suffered a serious compromise leading to the loss of 9-figure plus amounts of money yet?
• joeblau 7y ago
  I have USAA and they are pretty bad as well. Max password length is 20 characters. They only do MFA through cell phone numbers and email which allows someone to Sim-Swap if they are able to get your username and password. To top it off, they have a mobile app knock-off 2FA screen, but you _can not_ see it when you're trying to log in to your account via the mobile app because the modal doesn't let you leave the input screen. I was going to write them an email, but they have no clear email to report security concerns so I figured they don't care.
  • yellowapple 7y ago
    Extra stupidity: you literally can't use the USAA app on a rooted Android device; it'll detect that the phone's rooted and refuse to let you login. God forbid I assert control over my own goddamn device, right? It ain't USAA's job to lecture me about my own device security; its job is to shut up and show me information about my car insurance.
• whitepoplar 7y ago
  Given the nature of HN, I'm sure many of you have had inner-contact with financial technology infrastructure. Are there any banks that stand out for their technical competence/incompetence? Which bank(s) would you patronize/avoid?
• te 7y ago
  Sure, three-strikes-and-out reduces probability of brute forcing any particular account with forced 5-digit password, but if an attacker has a list of just 25k usernames, odds are that at least one is going to get brute-forced.
• kemiller2002 7y ago
  Wow this made me laugh. I spent long time working for banks, financial institutions, and credit agencies. "So many things that lock the account down" Really? Out of ALL of articles about breaking into systems leveraging techniques like lateral attacks on systems, and this is supposed to be believable. People ask me what it was like working there as far as processes etc. I always say the same thing. "Banks are like the mafia. They have a lot of money, and they don't like giving any of it away." Banks (especially) care about 2 things, money and risk. They spend just enough money to mitigate the risk and then stop. What this means is that they may buy good systems to help with security administration, but rarely did I see them take extra time to make sure they have multiple security redundancies like Troy describes. Employees were "trained" to what the letter of the law required. Don't get me wrong, there were some great people there, but let's not pretend they only hired from a select group of highly trained and extremely smart people. It's just like almost anyplace else. Employee's and contractors are there to get a paycheck and go home. They do what risk wants and when their done, bam they go home til tomorrow, because the fights just not worth it after a while. I briefly worked with a sales guy from a vendor we used, and he used to work in the banking industry. He had the best quote (that I shamelessly stole) to describe banks. He said, "If people knew what I know about banks, mattress sales would skyrocket."
• blackbrokkoli 7y ago
  People tend to get lost in mathematical technicalities in these discussion. Yes, even really dumb limitations leave 100k+ possibilities open, much more than you can brute force with a three-strike-lockdown. But that's not making it ok. Even if some crafty hackers on the other side of the world find a way to crack my account I'm confident the bank will look at the possible PR and legal costs and just refund my money fully, yes, yes, wonderful. That is not the problem. The problem is user inertia. Let me speak as an averaged one, mixed with my own deeds prior to being knowledgeable in cyber security. If I'm forced to remember my password because my password manager gets shut out or because of weird requirements, like uppercase letter + two numbers + non-alphanumeric, I'm nudged to use the same variation of my "default password" I used before, 27 times. "DognameBirthyear&". "+KeysThatAreCloseOnTheKeyboard1234+". And of course, I use a slight variation of that for everything. Shady web-server-under-the-desk web forum in 2007 three of my friends were on. Indie game servers, another classic. Bank. Google. It also was my facebook password which I gave to my bff once to check if that cute boy really liked me. It also can be guessed by obtaining my ID and watching me super slowly type the added non-alphanumerical at the end. This opens the very real possibility of revenge of ex partners, witty people at the coffee shop gaining access and the like. Crimes are committed overwhelmingly by people knowing the victim. No fancy AI is gonna help you with that, reasonable withdraws in the middle of the day in your time zone from your own MacBook's IP address. Good luck with customer support. You are enabling THAT with your dumb requirements. And why?? You are a bank, hire someone who knows their job and does not just act on blog spam FUD or whereever you got the idea of exactly 5 digits numbers only. No, I choose to be mad about this because there is no excuse for such horrifying UX and security. Just enforce a minimum limit of like four characters to prevent breach by putting down coffee mug on keyboard, enforce a maximum limit so you don't fall victim to an embarrassing flavor of DOS attack. If you feel fancy, throw a bunch of money at haveibeenpwned to check whether people are putting dumb passwords and let your local RegEx wizard check against all other silliness. There you go. I even waive you the $150k fee for that extraordinary piece of consulting.
• NotATroll 7y ago
  > Do you really think the only thing the bank does to log people on is to check the username and password? Yes. Yes I do. If you're putting arbitrary limitations on a user's password length, down to 6 characters even. I see no reason why you wouldn't be equally as insane with the rest of your system. And, frankly speaking. The whole "you're locked out after 3 attempts" non-sense is complete crap. What is this now? We're supposed to believe databases don't get hacked into, and hashed passwords aren't leaked on the net for countless people to hack at and break? This sentiment leads me to believe the passwords are stored in plaintext.
• yellowapple 7y ago
  Yeah, this is thoroughly disappointing - and alarming - coming from Troy Hunt. "Secret" security mechanisms that may or may not actually exist (let alone actually prevent attackers from successfully attacking) do not in the slightest bit excuse banks from their abysmal password policies. That he would not only accept that half-baked excuse at face value, but go so far as to regurgitate it and present it as if it's in any way reasonable, means that my perception of his trustworthiness now has a pretty substantial dent. I'm glad he at least acknowledged that banks should modernize their password policies regardless of their other security measures, but he's quite wrong to claim that we end-users shouldn't be incensed by banks' bass-ackwards security policies just because "well um uh they told me they're doing secret things so I'm gonna totally take their word for it and you should too". And no, account lockouts do not address the concerns caused by arbitrary password limits. Arbitrary password limits - be they for length or which characters can or cannot be used - are a rather bright red flag for storing passwords in plaintext, which means that when - not if - that bank inevitably has some kind of database leak, congrats, now the attackers don't even have to go through the trouble of brute-forcing or rainbow-tabling or whatever a bunch of hashes to get my plaintext password.
• ineedasername 7y ago
  If the thesis of this article were correct then there really shouldn't be much of any account hacking. I couldn't find anything that gives the prevalence of this, but there's tons of "what to do if hacked" articles and lots of posts on reddit/message board about "I was hacked! Will I get my money back?" Also, if the first line defense with passwords is poorly designed, why would these security-by-obscurity hidden ones be any different? Sure, you sign in form a new computer (or one that had its cookies deleted) and the site says "You haven't used this computer before, answer this security question: What is you Father's middle name?" That isn't a high barrier. If you know my name and a little about me, plenty of white-pages style sites show relatives etc.
• lovehashbrowns 7y ago
  That whole blog post was sad, but this quote was particularly dumb: > Banks like ING will give you your money back Now, I don't have any experience with having my bank account hacked, but I have had experience with my credit card getting used without my consent, and it's NOT a fun process. I can't even imagine how that'd go with a bank and a checking account. I can only guess that you have to 1. get the right customer rep on the line and 2. wait a good while.
• evanb 7y ago
  I recently lived in Germany and was impressed by the security mandated there. In order to do anything of note (meaning where you could lose money) you were challenged to produce a TAN, one six-digit number from a one-time pad of ~100 that the bank mailed you. You produce that number, cross it out, and never use it again. Also available were SMS TANs, where they texted you a code. I avoided these after reading about SIM swapping. But, further, was a photoTAN. The bank mailed me a private key that I entered into a reader app. Then they would present me with a QR-code-like image that the app could read and decrypt into a six-digit code via the secret key. Type that in, good to go. The reader app and the banking app also had some message-passing thing where if you were banking on your phone (and couldn't take a picture of your own screen...) it could still work.
• nsfyn55 7y ago
  They do matter but not for the reason you'd first think. It's about liability. Imagine a bank testifying in a hearing about a recent data breach. They are going to want to give the perception that they have done everything within reason to protect their user's data. Password restrictions are a cheap feather in one's due diligence cap.
  • zAy0LfpBZLC8mAC 7y ago
    So ... how exactly is "your honor, we didn't allow passwords longer than 5 chars" going to help them, you reckon?
    • nsfyn55 7y ago
      Easy. Civil law operates on a concept called "preponderance". It's not absolute in nature it's a measure of likliehood as measured by non subject matter experts(a judge and some randos). Imagine a person has fallen on your property and injured themselves. If you are known in the neighborhood as a person that takes care of your sidewalk(shovels, patches broken concrete, etc.) and can produce evidence(character witnesses, testimonials, visuals) to that effect your case is strengthened. No one ever got directly hacked because their password was too strong, but lots of people have had passwords guessed by brute force. So put the two together. Its beneficial to have strong passwords because they can be presented as evidence of due diligence and there is no security risk to enforcing them. There may be some business risk(people fleeing because they don't like your password policy) but someone needs to quantify that its a problem for it to be considered in the calculus.
      • zAy0LfpBZLC8mAC 7y ago
        That is a lot of text for not addressing my point at all!?
        • nsfyn55 7y ago
          You asked how it would help and I explained exactly how it would help. I directly addressed your point. Your content free, one sentence response not withstanding. Is there something specific you'd like clarification about?
• JulianMorrison 7y ago
  A bad short password is only protected against crude online guessing by aggressive lock-outs. If those passwords leak in hashed form, having a small search space means they can be broken offline with ease.
• pier25 7y ago
  Not sure why but banks seem to be consistently bad at web dev, at least on the front end. I have never used a good looking modern web app from a bank. Usually it's a slow bloated crap that looks and works like a project from 10-15 years ago.
• systematical 7y ago
  Still waiting on two-factor authentication from my bank. Even just basic SMS with a 4 or 5 digit code like Vanguard does would be nice.
• nitwit005 7y ago
  > banks aggressively lock out accounts being brute forced This is good, because it means people can't brute force the 5 digit password they forced you to use, but also bad, because if someone doesn't like you, they can easily block access to your bank. If the account numbers are sequential, or otherwise patterned, they may be able to block access to all users without using all that much bandwidth.
• daveFNbuck 7y ago
  Having 100k possible passwords and locking my account after 3 failed attempts does a pretty good job protecting a single account from being brute-forced, but you can still brute force access to some accounts if you can guess enough usernames.
• atoav 7y ago
  I don’t see how a bank that in 2019 doesn’t manage to have a decent password policy earns any trust on that front. If they allow for longer passwords with more characters the perceived security rises and in the age of password managers the usability gets better. If these advantages don’t outweigh the disadvantages of a bank, one could read this as a red flag regarding the systems behind that interface.
• QuantenGhost 7y ago
  What I hate is the impression. You can have mitigation controls galore. I trust that they all do. However, it's difficult for average customers to understand that. When even NIST has longer password recommendations, people who hear that "long passwords are safer" should have that option. Banks are relatively arbitrarily depriving security conscious people of that nominal opportunity to try to practice good password hygiene. The line is that password resets increase with password length. I'd be fine with that. I am an Information Security professional, customer of financial institutions, and started my earliest engineering career for a large bank.