53 ms·

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

• INTPenis 7y ago
  Some people have noted that they might store part of your password, but they could also be using some sort of master key to encrypt their passwords. Meaning they can also decrypt them and provide a UI for their help desk. Still awful, but not as awful.
  • FractalParadigm 7y ago
    Hypothetically, if that were the case, it creates a single point of failure for the whole system and is effectively "security by obscurity," imo. A malicious actor with the time, resources, and/or internal connections could obtain said master key and have access to the entire bank's database.
• tentboy 7y ago
  Since it seems this is PNC, I am one of those who now needs to find a new bank. Any recommendations? I used PNC for my checking/credit but already use an american express high yield savings. I was thinking maybe Capital One?
  • Eric_WVGG 7y ago
    no no no that’s just switching from Coke to Pepsi I’ve been using USAA for over ten years now, it's magical. Contrary to popular belief, you don't have to be a service member for it. If I couldn't have USAA I'd look into local credit unions.
    • tentboy 7y ago
      If you see my other comment, I don't think I am going to switch right now but it is good to check out alternatives. I am from the DMV area and capital one is huge here and pushes the narrative that they are an elite tech company VERY hard around here with recruiting. I figured they would have the most secure systems out there with the army of SWEs they recruit in this area
  • Spooky23 7y ago
    Why? The compliance requirements don't require hashing (iirc, "commercially reasonable" protection is/was the standard), so you should assume that any other bank is doing the same thing, as they probably are. All that is needed to steal your money is the bank account number, which you probably have mailed out or otherwise provided to numerous random third parties, who process them with other third parties. There's almost no information in there that isn't already available to anyone who cares to look. A more reasonable approach that actually impacts your security would be: - Opt-out of electronic communication and get paper statements and account notifications. (This ensures that you receive notice, in the mail, about changes of address and other changes) - Opt-in to notifications about large transfers or low balances. - Disable Bill Pay features at the bank. - Disable external ACH transfers. - Request wire transfer privileges, which with some banks allows you to get a physical token to secure access to your account. - Use a dedicated PC/iPad/Chromebook/etc for your banking to reduce the risk of malware capturing your banking details. If you're going to switch banks over this, look for a credit union small enough that they use an off the shelf banking solution, and figure out what the default configuration of the solution is.
    • tentboy 7y ago
      Thanks for recommendations. I will admit I overreacted when I saw the headline and found out it was PNC. Just not the thing I expected to start my day hearing. I already use 2FA, a unique password only with PNC and alerts on all account activity, including logins. I will look into some of the things you listed!
  • PascLeRasc 7y ago
    I moved from PNC to SoFi a few months ago and I'm very happy with them. ATM fees everywhere are automatically reimbursed and their customer service is fantastic. Make sure if you have a Virtual Wallet account with PNC to manually downgrade it to the lowest tier, and keep $500 in it until you're ready to close the account. It'll charge you $7/month otherwise, more if you're at a higher interest tier currently.
  • dontbenebby 7y ago
    Where are you located? I've had good experiences with Dollar Bank if you're in Pittsburgh.
• drenginian 7y ago
  Just do a Tell HN: Bank of Foogistan stores passwords in plain text. Don’t agonize about it so much it’s not like you’re going to hurt the banks feelings. No one will notice or care anyway and banks deserve what they get if they do this. And if the bank does pay attention they’ll just fix it and move on. Don’t know why you feel this is such a big deal. Who would you tell that would even care? I can’t imagine the police jumping into their car with sirens screaming. “I wish to report a terrible crime”.
• wj 7y ago
  Wells Fargo used to require that a new password be sufficiently different from an old password. e.g. if my password was "Madison111$" I could change it to "Madison222$" except that when I did so I would be prompted to change it again the next time I logged in. Since I always iterated on a version of my password this was an issue. The reason was explained to me when I finally called and asked why I was being required to change my password every single time I logged in. So, I changed Madison to Matthew and was good to go. Not sure how they were doing that if they weren't storing the password in plaintext.
  • apocalyptic0n3 7y ago
    It is definitely possible to do that. When the user submits a password to save, it hashes it and saves it to the database. At the same time, it calculates x number of variations of the passwords, hashes those, and saves those to the database as well. The next time you go to update your password, the hash gets compared against the actual previous hash as well as the x number of hashed variations and if any match, it gets rejected. Not super efficient and in most cases, probably not worth the effort. But completely doable to do.
    • StavrosK 7y ago
      How many variations will you store? It's very easy to calculate the Levenshtein distance on plaintext data, but basically impossible to enumerate all the variants and hash them.
  • Eric_WVGG 7y ago
    they could do it without plaintext by storing hash(/^[a-zA-Z]+$/)
  • helen___keller 7y ago
    One (devastatingly bad) way to do that is to store hashed subsets of your password string, say the first and second half, and if one matches then your new password is considered too similar to the old password Note that this demolishes the security protection of hashing because brute forcing two (n/2) length password hashes is much easier than brute forcing a length n password hash.
• daebersold 7y ago
  Move your money. Support your local/regional banks.
  • gruez 7y ago
    Are local/regional banks more likely to have better security practices? I'd think they have worse ones, especially since they don't have the money for cybersecurity consultants which are usually fixed cost.
• bodhi_mind 7y ago
  Hashing passwords has been ingrained into our brains as it's an easy way to reduce risk. That said, sometimes sensitive information needs to be stored in a retrievable format (subscription credit card processing comes to mind). Every data decision that's made has an element of risk involved while accomplishing an end goal. With the right processes in place (encryption, limiting access (auditing that access), decryption authorization), the risk can be reduced to an acceptable level. I don't think we have enough knowledge of the risk and processes in place at this bank to say if it's an issue.
  • coenhyde 7y ago
    I think you're prematurely jumping to the defense of this bank. What we do know is that the customer service rep was able to read the user's password in plaintext. Even if there is a "legitimate" reason for storing in a retrievable format (probably due to compatibility with legacy systems) the fact that the customer service rep could access that password tells me they do not have appropriate access control.
    • bodhi_mind 7y ago
      Just to play devil's advocate: What is a secure hypothetical way of granting access to an account when the customer lost access to their email and phone (so no pw reset or 2 factor authentication will work)? The bank has to have other processes in place. They're not going to keep your money from you. Let's say they accept a driver's license as authentication or a debit card. These methods are way less secure than a secret password and possibly introduce more security risk than a rep having access to view a password. A bad actor rep could then [almost] just as easily get a fake ID created to get the same access the password would have granted. I'm also assuming that the password was completely visible, not just a truncated version. This is the root of my concern of not knowing all the risks and processes involved. I don't want to jump to conclusions without knowing the whole ecosystem.
  • cranium 7y ago
    A password should be considered a user secret and never be available in readable form by anyone in the company. Here, instead of having a rep reading out loud the password, they should have done a password reset or something with the same effect. And let's not kid ourselves: if passwords are accessible in readable form they are eventually going to be read and used by someone ill-intentioned. There is no reason to have passwords in plain text, period.
• cal97g 7y ago
  Maybe you had a password hint they read back to you?
• slumdev 7y ago
  Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.
  • jcims 7y ago
    Lol it's been that way for at least 20 years. Same with chase (well at least the bank one half of it). It seems remarkably stupid, but it's way cheaper for them to refund any losses and/or pay for lifetime credit monitoring than it is to deal with customer service calls from people getting locked out because they can't figure out how to deal with uppercase and lowercase letters.
    • slumdev 7y ago
      I get that Amex would do this. It seems to be their attitude. They seem absolutely bent on eating the cost of fraud to make life easier for their customer. For the other banks, the motivation is harder to understand.
      • jcims 7y ago
        Same motivation. Call center costs related to account recovery are astronomical when you have tens of millions of customers. The authentication systems at large banks are generally a bit more 'observational' than just watching what password is sent (not always of course) so you can still mitigate many threats while still allowing for reduced login friction.
    • antisthenes 7y ago
      It's funny that my small-ish credit union is not only more technologically advanced, but also way more ethical (looking at you, Wells Fargo) and convenient, and has top notch customer service. Seriously, I've never interacted with more pleasant customer service reps than my CU. Why are people giving their money to big banks again? Is it just advertising pressure?
• thdrdt 7y ago
  Can you explain what you mean with "describe my own password to me". As other point out: maybe they store some things about your password like "has four digits, starts with an S". This does not mean they store your password in plain text. Everybody here starts shaming and naming but be very careful with that. Before you know it you shame a company while there is nothing going on.
• mgamache 7y ago
  The password is probably encrypted using a two-way hash. It's not as secure as a one-way has, but you can't see passwords by running a SQL query.
  • resoluteteeth 7y ago
    What is a "two-way hash" and how is it different from normal encryption?
    • mgamache 7y ago
      https://cs.stackexchange.com/questions/69422/two-way-hash-functions https://cs.stackexchange.com/questions/69422/two-way-hash-fu...
  • _fizz_buzz_ 7y ago
    What's a two-way hash? Isn't it just a cipher at that point?
    • mgamache 7y ago
      https://stackoverflow.com/questions/4948322/fundamental-difference-between-hashing-and-encryption-algorithms https://stackoverflow.com/questions/4948322/fundamental-diff...
• avbanks 7y ago
  There's a similar issue with Wells Fargo. I think it has to do with banks they acquired (in my case Wachovia). My passwords are not case sensitive.
  • viggity 7y ago
    Wells Fargo isn't really Wells Fargo. It was a massive bank in the midwest called Norwest (based in MN, but offices all over midwest). Norwest acquired WF primarily for the superior name recognition. The merger with Wachovia happened after that. for the longest time they you could set your password to be anything, but they only checked the first 8 characters and it wasn't case sensitive. Just chalk it up to shit being written in the 80s.
• bob1029 7y ago
  As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incompetence, but simply the acknowledgement that the legacy systems will not enjoy PBKDF hash+salt+iterations columns being added 30 years after the fact. The risk analysis and mitigation discussion for these institutions goes something like this: 1) We cant have good password storage so we will require a 2nd factor and attempt to ensure these systems reside in our most secure network. 2) There is nothing we can do, so we will simply rely on the fact that if someone logs into an account illegally, we send in the men with guns. For some strange reason when a bank calls the FBI things move with a high level of expediency. There is much more to this than just the technical aspect of "oh my goodness why aren't you hashing your passwords". How much ripping would HN impose on one of these institutions if they attempted a 100% best practices secure password upgrade and then subsequently had a complete IT disaster unfold (I can certainly link articles). For many banks and other financial institutions, going down for even 1 hour is a complete catastrophe. If people can't get their money out right away, they are leaving for the competition and you will likely get dinged by regulators. Bad people will continue to do bad things until the end of time. Killing your business to handle every edge case, even if it seems obvious, is not a good path to go down. I would also consider this: These banks' IT systems are storing things that many of us would argue are much more valuable than your passwords. A bank's core system also represents the actual monetary value of every customer's account. We are talking about password security in a system domain where there are arguably far more valuable assets to secure. These assets are already implicitly protected by a massive apparatus extending as far as Ohio Class nuclear submarines patrolling the Pacific ocean.
  • kevin_thibedeau 7y ago
    So they can add columns for 2FA but strengthened password storage is not doable? This was forgivable 30 years ago. It was bad practice 20 years ago. Someone could have demonstrated leadership and developed a ten year plan to fix their legacy problem then.
• jacobsenscott 7y ago
  perhaps it is encrypted, rather than hashed.
• huac 7y ago
  Fidelity's passwords map to characters on the phone keymap, e.g. the characters "j,k,l,J,K,L,5" can all be represented by the number 5 on the phone. Holy entropy, Batman!
  • euix 7y ago
    I can attest to this. When you call in you just have to type in your alphanumeric password completely using the 10 digit phone pad. Just like in the 90s. On the other hand Fidelity has the best customer service I have ever experienced so I guess everyone has competencies.
• exabrial 7y ago
  Nearly all of them do unfortunately. They will only change this after getting hit with massive fines from a data breach. What you should do: Never reuse a password when working with financial institutions older than 5 years old.
• satya71 7y ago
  That's still better than the SSA. Every employer must use SSA to submit W-3 to report employee wages. They only accept case-insensitive passwords up to 8 alpha-numeric characters.
• throwbanktest 7y ago
  (Throwaway for obvious reasons) Proud of my bank in India (State Bank of India) which is crazy over security. Secure password requirements for login. Another completely different password for managing my banking profile and adding bank transfer beneficiaries. OTP for each money transfer related activities I do from the bank.
• solumos 7y ago
  A friend of mine wrote a newsletter on this topic last year - banks are full of anti-patterns! https://whyisthisinteresting.substack.com/p/why-is-this-interesting-the-security https://whyisthisinteresting.substack.com/p/why-is-this-inte...
• greenie_beans 7y ago
  can you tell us the name of this bank so we can avoid business with them ?!
• baby 7y ago
  They have to no? If you want to link some other bank accounts you have to give them the associated credentials that they pretty much have to store in clear (or encrypted at rest whatever).
• loufe 7y ago
  My bank just changed from a 6-number password (literally no option for more or less characters nor anything but digits) to rational passwords this month. I don't know how my WoW account 10 years ago needed an authenticator but the people managing my retirement savings didn't light a fire under asses to get that done. Legislation should have and likely still should be put in place.
  • nolok 7y ago
    Your wow account security was done with post-2000 tech, your life saving account security still depends on 1970s mainframe rules. I agree about the legislation part.
• mywacaday 7y ago
  I was going to say vote with your money and leave but then it occurred to me where do you go, is there any public list of banks or institutions that have passed some kind of security audit?
• topkai22 7y ago
  Does anyone know if PCI rules call for non reversible storage of passwords (hashing)? I looked quickly online but the only reference I could find was that "passwords are protected by strong cryptography in transit and at rest", which seems to allow wiggle room to store passwords in reversible but encrypted format.
• NicoJuicy 7y ago
  Of the bank is in Europe also, it's a GDPR breach
  • szatkus 7y ago
    How? My qwerty123 password isn't information directly connected to my identity.
    • NicoJuicy 7y ago
      GDPR Password Policy: Critical Components https://www.enzoic.com/gdpr-password-policy-critical-components/ https://www.enzoic.com/gdpr-password-policy-critical-compone...
• mindslight 7y ago
  Use a generated unique password for every site, preferably with a password manager. Along with the absolutely most important thing you can possible do for banking security, which is to check your statements/transactions promptly every 30 days. Beyond that it's not really your worry, besides having to possibly attend to helping them clean up any messes.
• rlewkov 7y ago
  1) Inform the bank 2) Inform the FDIC 3) After a reasonable amount of time inform the public
• overgard 7y ago
  I once did an API integration with a very popular well known brokerage. When we asked for a test account for their API... well they didn't have a test environment, so they just gave us a real account with 10k dollars in it with instructions to be careful. The test account was something like "apitest11" and the password was like "11apitest". Did that money mysteriously get stolen? Yup! (Not by me definitely, but that account must have been shared with 15 or so people, with a trivial password if it had been an outsider)
  • deleted 7y ago
    [deleted]
• vegardx 7y ago
  It never ceases to amaze me what the state of online banking is around the world. Here we have something called BankID which comes in two flavors, one that is a physical token that generates TOPT used to log in, either in a combination with a password or a PIN on the token device itself, referred to as BankID. And the other, much slicker solution, called BankID on Mobile, which runs as SIM-application on your phone where you digitally sign the login request using a PIN. The user can also verify the request visually on both the computer and phone using a unique keyword. One killer feature with BankID is that you can use it to log in to any service that has BankID, like your insurance company, looking at your tax return, other banks, etc. This is perhaps the biggest issue with it since the system can get overloaded when there's a country wide rollouts of tax returns and such. This has become much better lately since they've started to roll out things like tax returns as soon as they're ready instead of doing bulk releases.
  • rimliu 7y ago
    Sweden? Here (Baltics) we have SmartID or mobile signature or hardwire password generators (TOTP). No stupid passwords.
    • vegardx 7y ago
      Norway, but I would imagine it's the same or same-ish solution given that banks in Scandinavia and Baltics operate more or less the same way.
• riffic 7y ago
  name and shame.
• micheljansen 7y ago
  Really shocked at all the handwavy comments. > “It’s fine, there are more checks in place to prevent unauthorised transactions” > “Also, it’s insured” Well ok, that means the bank is protected, but what about my (sensitive) data such as transaction history? > “If anyone does anything bad, law enforcement will step in” Yeah, I totally trust a bank that can’t even properly deal with something as basic as passwords to notice breaches reliably. > “It would be too expensive to replace legacy systems” And that’s the consumer’s problem? I really hope none of you apologists are moving fast and breaking things at any company that is entrusted with people’s personal information or is needed for more critical infrastructure of everyday life than cat pics and funny polls. In Europe banks also don’t like paying to replace legacy systems to maintain security, but such a failure to protect consumer data and privacy would be in serious breach of legislation and result in significant fines.
  • rodw 7y ago
    > such a failure to protect consumer data and privacy would be in serious breach of legislation I imagine this is true in the US also (which may be why the OP asked about reporting this). > result in significant fines This part I have less confidence in. :(
  • godelski 7y ago
    >> “If anyone does anything bad, law enforcement will step in” >Yeah, I totally trust a bank that can’t even properly deal with something as basic as passwords to notice breaches reliably. As an example of this: Equifax. This happened in 2017, and not really much has happened and people haven't been prosecuted. So everyone got some identity theft protection for a year. That didn't solve the problem. Equifax lost a little money. So little changes. And the claim is that it is Chinese state actors that did this, so no one will get prosecuted (because we just let China attack us?). So handwavy seems defeatist. Also, if this is a major bank, then Equifax is a great parallel to draw from.
    • TecoAndJix 7y ago
      Link to the symbolic indictment - https://www.justice.gov/opa/pr/chinese-military-personnel-charged-computer-fraud-economic-espionage-and-wire-fraud-hacking https://www.justice.gov/opa/pr/chinese-military-personnel-ch...
• pedalpete 7y ago
  This is doubly bad because not only is your password in plaintext, it also means that anybody who works for the bank is able to view said password. Don't get me wrong, plaintext stored in a DB is bad enough, if the DB gets compromised, but apparently they don't even need that as they have an interface that customer service can use to view your password. How secure do you think that system is?
• paulie_a 7y ago
  Name and shame
• speedplane 7y ago
  The law is not behind or antiquated in this case. Bank cybersecurity has been regulated for quite some time now, and failing to adequately secure your digital assets is a compliance violation no different than failing to catch obvious fraud. It's very likely that your bank is based and regulated by New York State, even if it isn't physically based there. Contact the NY State attorney general's office, they should take you seriously.
• neutrin0 7y ago
  You definitely need to tell somebody that they should be encrypting their passwords using something like Format Preserving Encryption. FPE https://www.tokenex.com/blog/format-preserving-encryption-and-nist-800-38g-what-you-need-to-know https://www.tokenex.com/blog/format-preserving-encryption-an...
• imtringued 7y ago
  It is possible that this is intended and that they will prompt you to enter a new password on login. Ask yourself these questions: Are you sure it was your password? Did they generate a password for you? Did they verify that you are the account owner by asking you to enter the "hotline-pin"?
• tibbydudeza 7y ago
  My bank uses 2FA or biometric via their android app to approve all payments and adding of new beneficiaries on their online banking platform. But it is a pain when I switch phones and need to get the old one deactivated and the new one authorized.
• tylerburnam 7y ago
  You should give them 7 days and tell them you have a responsibility to let the community know what bank it is. You should communicate this clearly to the bank and then let us know.
• jonplackett 7y ago
  Banking security is a joke. My bank calls me to talk to me and insists I give them my date of birth and address to ‘verify’ myself. Meaning anyone can call me, pretend to be my bank, I am supposed to give them this info, and then they have what they need to verify themself as me. Banks are dumb.
  • anonsivalley652 7y ago
    I did some tech consulting with some ex-banking Wall St. consultants. It's not a monolith. That industry is very conservative.. and some companies get so frozen in time that they become complacent and go full Equifax. They're always playing catch-up because every criminal and most people would like to rob a bank without a gun, so their threats are numerous and perpetual. (And then there's Wells Fargo.) It seems like banks should adopt that credit-file-based challenge protocol with the multiple choice questions containing ~50% or so spurious data that answers (None of these). I had to do it to reset a hospital's patient login for myself the other day. DOB, SSN, address, phone number aren't secret-enough "things you know" or "things you can do." For signatures, I always sign a smiley face because they're completely worthless. Perhaps even better would be to: 0. have the bank have a relationship with the customer 1. issue 2FA device or soft-2FA 2. use per-customer colors, pictures and words on the password screen to deter impersonation and phishing attacks 3. It seems like hardware is so cheap these days, the bank could issue customers a hardened tablet with a pin, biometrics & face recognition that VPN'ed back to them and functioned only for their banking apps. It's much easier to support and harden one controlled device than zillions of likely malware-infected Chrome on Windows 10 or macOS Catalina's Safari on unsecured public WiFi.
    • gruez 7y ago
      >2. use per-customer colors, pictures and words on the password screen to deter impersonation and phishing attacks I've seen this on multiple sites, and I always thought it was snakeoil. All you need to do to bypass it would be to make your phishing server contact tho bank to request the per-customer color/picture/word.
    • jonplackett 7y ago
• davismwfl 7y ago
  Wow. Did they repeat your password or some hint you typed in a long time ago? FWIW I have seen two companies that store passwords properly in a one way hash with salt but store statistics on every password like number of case changes and count of numbers and total length. I personally think that practice is infinitely stupid but can explain why they can say it has 3 numbers in it. One major marketing firm I did work for did that until we showed them why it was so dangerous. They were just trying to make users life easier but that wasn’t a smart trade off. Personally I would like to know which bank. I have accounts at a number of major US banks and if one I use is doing this I’ll move everything out of them immediately. Edit: to answer your question I’d hand the info to a major investigative news source and let them dig more. The FTC and banking regulators I don’t think will get involved unless there was damage.
  • plsdonthack 7y ago
    They're a three letter acronym that starts with P and ends with C.
    • secone 7y ago
      Shoot. They are pretty open about the fact that their passwords are case insensitive. I had always hoped this was some clever implementation using multiple hashes upon password creation. Or tolower() everywhere. If it's true that they're able to read it back though, then why would they bother?
    • diebeforei485 7y ago
      Holy smokes. See if you can get in touch with someone in the financial press (such as the Wall Street Journal).
    • deleted 7y ago
      [deleted]
    • mav3rick 7y ago
      Pnc ?
    • 7y ago
• rs23296008n1 7y ago
  Move your money to a different bank. Now that banks aren't paying useful interest rates they are mostly only tolerable for security and convenient access to your money. If they can't do those two then... what exactly are they for? Likely nothing.
  • OldFatCactus 7y ago
    are any banks paying useful interest rates?
  • plsdonthack 7y ago
    It's for an auto loan.
    • baldeagle 7y ago
      You may be able to refinance it.
    • markiannucci 7y ago
      Hopefully you did not set up ACH to withdraw money from your real account.
    • rs23296008n1 7y ago
      Be extra careful with your details associated with that account and anything it touches. eg any direct debits might "change" without notice. Enable all added security you can. But realistically, there's no silver bullets. Refinancing can be expensive. Cost/benefit applies: Might not be worth refinancing just for this. Just be vigilent about the accounts involved. I had a phone company that bragged about its security. So I tested them out. Yup they sent my password via text. Ok then. Contract was for six months. Not worth switching. But also not worth renewing.
• rasikjain 7y ago
  You should report to proper authorities about the severity of the issue. Reach out to their security or technical higher up department of the bank. In your case, they may or may not be storing the password in cleartext. They might be using the two way encryption instead of one-way hash. Passwords should be hashed (with salt) and it is irreversible. For a financial institution, revealing your password by a customer service rep is a big red flag. I would reach out to concerned authorities and do a proper disclosure.
  • notyourday 7y ago
    > You should report to proper authorities about the severity of the issue. Reach out to their security or technical higher up department of the bank. Switch your bank. Do not reach out to the bank's security/technical! There's a non-zero chance that the response from the bank would be to reach out to the FBI and claim that you are the "hacker". It will create an enormous headache for you. If you are going to reach out to anyone, reach out to the OCC.
    • carapace 7y ago
      https://www.occ.treas.gov/ https://www.occ.treas.gov/ ?
      • notyourday 7y ago
        Yes
    • rasikjain 7y ago
      Thanks for clarification. Wasn't aware of OCC.
    • pc86 7y ago
      Does storing passwords using two-way encryption violate some OCC regulation?
      • notyourday 7y ago
• robjan 7y ago
  Was it a password or secret question like "mother's maiden name"?
• matz1 7y ago
  Is there actual damage? At the end of day, as a customer，all I care is my money is available (not stolen) and I can access it when I need it. Why should I care about implementation details ?
  • danbolt 7y ago
    I feel the bank should be liable for stolen funds or information in the case of a security breach.
    • wheelerwj 7y ago
      They are... there's also multiple levels of insurance to cover it.
    • matz1 7y ago
      Yes, I expect the bank to protect my money. What I'm saying is how they actually do it, clear text pwd or whatever is not really my concern. Why should I ?
      • Aloha 7y ago
        This the most intelligent thing I've heard on this thread. So long as I'm not holding the bag should my account with them go haywire, I don't care. This is why shared passwords are bad.
      • toper-centage 7y ago
        Sounds like they are open to social engineering attacks, if you can get a rep to describe the password to you... Meaning I could pretend to be you and get your money.
        • matz1 7y ago
          Maybe but that is their problem. Its still the bank responsibility to deal with that.
• loteck 7y ago
  Genuinely curious, why not name the bank here? It certainly isn't going to be news to the bank itself, so there aren't responsible disclosure concerns here. And since the top advice here is to leave the bank, wouldn't the best thing you can do be to alert the public, so others can protect themselves as well?
  • baron816 7y ago
    Looks like it’s PNC. Everyone here, move your money now.
    • altcognito 7y ago
      Or don't make financial decisions based on vague anonymous internet comments until you've investigated for yourself.
      • prklmn 7y ago
        Do you want this person to mount a full blast investigation on their own? Most banks are mostly interchangeable nowadays unless you live in a small town and there’s only one bank you must use because you’re transacting with cash. They pay nearly zero interest, and they treat their customers like trash with monthly fees galore.
        • thinkingemote 7y ago
          Thank you, yes I will certainly change all my financial set up based on no further information these two alarming comments. Who needs to look further into things - they are all the same after all.
    • dantillberg 7y ago
      But to where? Do any banks exist that have reasonable security procedures?
  • exikyut 7y ago
    One weak argument: Finance is between 20 and 50 years behind the curve in terms of fundamental/top-down security common sense, notwithstanding the handful of specific exceptions strictly necessary to ensure accounts are not actually made off with on a regular basis. There are likely a good handful of hair-raising security issues (known and unknown) impacting your account(s) right now, that would cause you to scream and run were to learn of any single one of them (let alone the full list). In this light, cargo-culting specifically [only] avoiding environments that store passwords in plain text feels like premature optimization. With the above being said, I do agree with the sentiment raised elsewhere of contacting annoying persistent organizations that will follow up - apparently in this case that's investigative journalists and the OCC. Just don't forget the bigger picture.
• foreigner 7y ago
  Something similar happened to me once. An e-commerce platform gave my wife my plaintext password. It was my "low security" password, the same one I used in dozens of sites. That's when I started using a password manager so now every site gets a different random password.
• lpilot 7y ago
  Santander in the UK does this too. You can tell because they only ask for 3 characters out of your password whenever you log in. What's ironic is that whoever did that propably thought they were being super clever.
  • deforciant 7y ago
    Other banks in UK do that as well, shouldn't they all be reported for this?
    • daveoc64 7y ago
      To whom, and on what basis? There is nothing in UK law that says banks have to store your passwords "securely". Issues like this have been raised in the past, and authorities like the ICO have said no law is being broken. GDPR, for example, does not specify technical mechanisms required to store any form of data.
      • Recursing 7y ago
        See https://news.ycombinator.com/item?id=22356101 https://news.ycombinator.com/item?id=22356101
        • daveoc64 7y ago
          Unfortunately, they are still non-committal on what is required. They advise that passwords should be hashed, but there is nothing that makes that a binding requirement. The gist is still "do what you think is appropriate". The ICO talks about balancing risks and convenience, and the banks will argue that their systems are secure overall, and don't make the consumer liable anyway. Under the ICO's guidance, an organisation could argue that plain text (or reversibly encrypted) passwords allow them to do things like password reminders. You or I might think that's terrible, but they can argue that it's a better user experience.
          • Recursing 7y ago
• alltakendamned 7y ago
  It seems you're not getting serious answers here, so here's my take. Please report this via the US-CERT at https://www.us-cert.gov/report https://www.us-cert.gov/report This will allow you to report it, eventually from an anonymous email address, without exposing you directly to the bank which might react bad to you. CERT can handle the coordination with the bank, this is what they do.
  • speculator 7y ago
    Really good suggestion. And in case they still need encouragement, some negative press coverage might get them going. Right person for this -> https://krebsonsecurity.com/ https://krebsonsecurity.com/
    • jakub_g 7y ago
      Came here to write that. Either Krebs or https://www.troyhunt.com https://www.troyhunt.com
      • hamiltonc 7y ago
        And this: https://robertheaton.com/2020/02/07/send-me-your-privacy-abuse-tipoffs/ https://robertheaton.com/2020/02/07/send-me-your-privacy-abu...
    • sneak 7y ago
      I do not think that recommending Brian Krebs is a good idea for someone who might wish to avoid retaliation. Recently, he doxxed some people on Twitter for reporting bugs. https://www.itwire.com/security/infosec-researchers-slam-ex-wapo-man-krebs-over-doxxing.html https://www.itwire.com/security/infosec-researchers-slam-ex-... As a result, I no longer visit his site or recommend his work. Publishing someone else’s personal data without consent is a terrible thing, and is one of the reasons so many of us work to secure systems. His behavior undermines that.
      • guiambros 7y ago
• deleted 7y ago
  [deleted]
• aichi 7y ago
  Same surprise for me when I got back my password from AMEX over phone.
• akerro 7y ago
  When I went to TSB (UK) open an account for my partner and she was asked to type her password on their computer she asked when she can change the password, are they any limitations, like wait 3 days before changing password. The assistant responded "why would you ever want to change your password? you can type any password you want now, just please type your password". This was so weird we didnt use the account for a few days, changed the password, waited a few days again and after that deposited money.
  • mehh 7y ago
    But you were talking to a clueless bank clerk, not their Chief Infosec Officer, so not really that significant.
• Urgo 7y ago
  If this is really happening this is a serious issue that needs to be fixed ASAP and everyone alerted.. but.. something doesn't look right here.. OP is a throwaway account created today, which I can understand for this type of thing.. but... they withheld the bank name in the title/desc.. okay again a responsible thing to do.. but... when asked what the bank name was in the comments they were not shy at naming it.. Something just doesn't feel right. Why the sudden change of heart? For everyone's sake I hope I'm right, that this is just FUD.. to the OP if you really are serious I'm sorry, and please do report this ASAP.
  • plsdonthack 7y ago
    Unfortunately I'm not awake at all hours of the day to respond to internet comments. But if you want further evidence that their passwords are indeed stored in plaintext, consider that their password rule prohibits the special characters !, /, \, <, >, etc. You can verify that yourself.
    • ncallaway 7y ago
      How is that evidence of plaintext storage? Couldn't they do that validation before they hash the password, but still store a hash? I'm not saying they don't store plaintext, but restricted character's are absolutely not incompatible with hashed passwords.
    • perpetualpatzer 7y ago
      This is weak evidence as these rules could be implemented at the point of new password entry, prior to encryption/storage.
    • kgwxd 7y ago
      I once used a small DNS hosting provider where I used a password ending in '!!'. I was in the process of attempting to transfer the domain to another host but it was taking them days, and they communicated several times they were having odd issues specifically with my account. In that same time I was learning how to use Linux and MySQL, and ran into issues using the same password for the MySQL admin during a command line install. That's when I learned !! is short for "run last command". Took me a few more days to think maybe that's what was causing issues at the host provider, so I changed it, told them what I did, and asked to please try the transfer again, and it worked. I never got confirmation the password had anything to do with it, but I let support know my suspicions.
• fazilakhtar 7y ago
  I got locked out of my account (forgot my password) with said bank and they had no way of telling me my password. Had to wait for them to send me a OTP mailer so that I could login and create a new password.
• 0x3RO 7y ago
  Do you really think the only thing the bank does to log people on is to check the username and password? Banks are way more sophisticated than this and it goes well beyond merely string-matching credentials; there's all sorts of other environment, behavioral and heuristic patterns used to establish legitimacy. Even if you rose this issue with the bank, they'll hardly change their modes of operation, and you certainly won't ever see a bank telling you how they do it, but those "hidden security features" make a significant contribution to the bank's security posture; ie: https://twitter.com/mbna/status/1016270694299127809?s=20 https://twitter.com/mbna/status/1016270694299127809?s=20
  • dwnvoted2hell 7y ago
    https://yourlogicalfallacyis.com/no-true-scotsman https://yourlogicalfallacyis.com/no-true-scotsman Fallacy much?
  • gruez 7y ago
    >but those "hidden security features" make a significant contribution to the bank's security posture Which is totally bullshit because I have RFP enabled in firefox, and I get asked for my security question on every log in, even though my password is randomly generated and reasonably secure.
  • 0x3RO 7y ago
    In addition to this, you might be interested enough to take note of a number of your banks arbitrary password rules, that one could follow to make similarly negative assumptions. ie; "hey [bank], because my password is limited to 16 characters, does that mean you've got a varchar(16) column somewhere storing plaintext?"
• alkonaut 7y ago
  What does the password give access to? Full online banking (e.g. being able to do transactions?). Does login not require any further authentication beyond the password? If the authentication still requires using some kind of good 2FA then it's less serious to have the password in plaintext. Still bad of course. If this is for some other service that doesn't let you do any transactions then it's not as serious either (still bad and embarrassing, but not that serious) Even with properly hashed passwords etc I'd be worried if my bank allowed login with only a username/password and no further security. I didn't think even that was a thing in 2020.
• _Understated_ 7y ago
  Why not reach out to someone like Brian Krebs? He has a pretty large reach and can potentially make people take notice. Try @briankrebs on Twitter.
  • btrettel 7y ago
    There's a blog specifically dedicated to highlighting examples of plain text storage of passwords too: https://plaintextoffenders.com/ https://plaintextoffenders.com/
  • wtmt 7y ago
    This is the best way to go about it if people at the bank aren’t responding. Nobody likes a PR nightmare, and Brian Krebs can handle this better with the right people if the OP provides enough evidence.
    • cpv 7y ago
      "Almost without fail at each engagement multiple C-level folks will approach after my talk, hand me their business cards and say something like, “I hope you never have to use this, but if you do please call me first.”" https://krebsonsecurity.com/2019/12/ciso-magazine-honors-krebsonsecurity/ https://krebsonsecurity.com/2019/12/ciso-magazine-honors-kre...
  • Wheaties466 7y ago
    Alternatively I feel like Troy Hunt may also be able to help https://twitter.com/troyhunt https://twitter.com/troyhunt He runs the @haveibeenpwned service
    • daveoc64 7y ago
      Troy has actually covered a similar topic to this in the past: https://www.troyhunt.com/banks-arbitrary-password-restrictions-and-why-they-dont-matter/ https://www.troyhunt.com/banks-arbitrary-password-restrictio... His viewpoint seems to be that poor security practices around passwords in banks are not a big deal, due to the overall processes that banks use to prevent fraud.
• zxcvbn4038 7y ago
  There is not much you can do, I’ve tried to inform banks of security issues in the past and all that happens is you get a form letter saying thanks for writing we are doing that on purpose for reasons we can’t explain to you and we’re not interested in outside help. Synchrony and Citibank, I’m looking at you.
• crispyambulance 7y ago
  > The service rep proceeded to (accurately) describe my own password to me. Wait, that alone doesn't necessarily indicate that they're storing clear text passwords. I notice you didn't say that they just repeated your password to you-- why do you think they store the whole thing in clear text? HN readers are apt to demand hardcore passphrases, salting, 2FA, etc. But the reality is that banks have to deal with all kinds of people and situations. Your security as a bank customer hinges on more than just one password, it's also about monitoring patterns of behavior, being aware of what's coming and going from your account, and protection mechanisms like the bank's insurance. That said, one would think that large institutions have learned their lesson about clear text passwords, perhaps this one hasn't? Is there a law against clear text passwords? How does anyone actually know if a financial institution has sound IT practices, by happenstance incidents like this? Really?
  • Recursing 7y ago
    > Is there a law against clear text passwords In Europe GDPR covers that, many big websites started hashing after it Edit: could somebody explain the downvotes? The comments seem to agree with me Obviously GDPR is not a law about plain text passwords, but as the comments say it forces "the use of an appropriate hashing algorithm to store your passwords, protecting the means by which users enter their passwords, defending against common attacks and the use of two-factor authentication." etc.
    • madeofpalk 7y ago
      Really? Edit: Kind of. The UK org in charge of GDPR says: > Although the GDPR does not say anything specific about passwords, you are required to process personal data securely by means of appropriate technical and organisational measures. > Passwords are a commonly-used means of protecting access to systems that process personal data. Therefore, any password setup that you implement must be appropriate to the particular circumstances of this processing. > There are a number of additional considerations you will need to take account of when designing your password system, such as the use of an appropriate hashing algorithm to store your passwords, protecting the means by which users enter their passwords, defending against common attacks and the use of two-factor authentication. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/security/passwords-in-online-services/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
• benmmurphy 7y ago
  A popular bot protection system provided by a third party used by a number of US banks would accidentally disclose plaintext usernames and passwords to the bot protection software. I'm not sure how the bot protection software was deployed but looking at marketing materials I suspect the data was sent to the third party as part of a SAAS service. We believe this was accidental because a later version of the software stopped doing it. I'm not sure if there was a notification by the third party to users about this flaw.
• chris_overseas 7y ago
  One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characters long(!) consisting only of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password: https://banking.westpac.com.au/ https://banking.westpac.com.au/ I complained to them about this years ago, they replied explaining they knew what they were doing and it was a balance between security and simplicity...
  • reactor 7y ago
    Mainframe it is then.
    • znpy 7y ago
      could be (old) cobol, not necessarily on a mainframe
  • the_french 7y ago
    Even worse, a major French bank removed their perfectly fine password requirements and replaced it with a 6 digit PIN that you have to enter via an on-screen numpad. They explicitly block password managers from autofilling too! And I had just managed to get my parents to start using one.
    • chris_overseas 7y ago
      Well Westpac had an onscreen keyboard for the password entry too until about 18 months ago. When they finally replaced it with a (thankfully password-safe friendly) text box they had this to say: "At Westpac, we are continually striving to provide the highest quality service and security to help support our Online Banking customers. From the end of May 2018, we will be removing the keypad from the online sign-in screen and replacing it with an open text box, which allows you to type in your Customer ID and password. ... Security Guarantee. We assure you that using the open text box to enter your sign-in details carries the same high level of security ..." Passwords remained fixed at 6 characters however.
• dwnvoted2hell 7y ago
  If you want to stay with this bank, you should should create a password from a strong one way military grade hash. This way, you can still more or less recreate the password, but if it's lost it tells nearly nothing about the original password you came up with, especially if you applied a salt (and/or pepper) to it.