3 ms·

Wow. Did they repeat your password or some hint you typed in a long time ago? FWIW I have seen two companies that store passwords properly in a one way hash wi

Wow. Did they repeat your password or some hint you typed in a long time ago? FWIW I have seen two companies that store passwords properly in a one way hash with salt but store statistics on every password like number of case changes and count of numbers and total length. I personally think that practice is infinitely stupid but can explain why they can say it has 3 numbers in it. One major marketing firm I did work for did that until we showed them why it was so dangerous. They were just trying to make users life easier but that wasn’t a smart trade off. Personally I would like to know which bank. I have accounts at a number of major US banks and if one I use is doing this I’ll move everything out of them immediately. Edit: to answer your question I’d hand the info to a major investigative news source and let them dig more. The FTC and banking regulators I don’t think will get involved unless there was damage.

plsdonthack 7y ago
They're a three letter acronym that starts with P and ends with C.
- secone 7y ago
  Shoot. They are pretty open about the fact that their passwords are case insensitive. I had always hoped this was some clever implementation using multiple hashes upon password creation. Or tolower() everywhere. If it's true that they're able to read it back though, then why would they bother?
- diebeforei485 7y ago
  Holy smokes. See if you can get in touch with someone in the financial press (such as the Wall Street Journal).
- deleted 7y ago
  [deleted]
- mav3rick 7y ago
  Pnc ?
- keenmaster 7y ago
  Wow, they should know better. That’s really mediocre if true. Call the OCC consumer hotline which is listed at the following link https://www.occ.treas.gov/topics/supervision-and-examination/dispute-resolution/consumer-complaints/index-consumer-complaints.html https://www.occ.treas.gov/topics/supervision-and-examination... Tell them you’d like to file an “Official Complaint” regarding a serious cyber security issue at that bank, and to transfer you to whoever handles official consumer complaints regarding cyber security. Regulators are sensitive to the word “complaint” (specific wording matters) and typically require that complaints are stored, prioritized, and handled in a prescribed way. Ask them if they can get back to you with any resolution and leave your contact information. Update HN if you’re comfortable with that. Good luck.
- dawnerd 7y ago
  That's about run of the mill for them (assuming we're thinking of the same bank). I called about my mortgage and they started reading off someone else's information. They also wanted me to confirm personal information over email...
- davismwfl 7y ago
  Wow, not good for such a large bank. Holy crap.
netsharc 7y ago
I know a bank (I forget which, in EU) that asked me for the 3rd and 5th letter to my password when I called them. Their thinkkng was probably that way the customer support on the other end would only see 2 letters of said password.
- Al-Khwarizmi 7y ago
  My main bank does this all the time. To be honest, while I'm aware it's not the best of practices, I don't care much. To me, the most important thing about bank security is that if there are fraudulent operations in my account, I can call and have them undone without much fuss. In this respect, my bank has behaved well in the past when random charges from an exotic country appeared in my credit card, in fact they noticed before I did, gave me a call and everything was fixed immediately. For this reason, I think I'm OK with banks not having too strict security practices. If at some point they start being really paranoid about security, they might feel tempted to conclude that if there is fraudulent activity, it must surely be the client's fault, because their systems are unbreachable. I'd rather have the current situation in which I don't have much responsibility about security, problems happen but the bank responds.
- kitd 7y ago
  My UK bank has a "memorable word" which is separate from the login mechanism (which uses a physical TOTP pad). Authorising online transactions requires you to give "3rd, 6th & 10th letters" eg of your memorable word. Are you thinking of that?
- alex_hitchins 7y ago
  With my bank, the telephone banking password is very different from the one you use to log in.
- lozenge 7y ago
  This also avoids replay attacks. Unless you use a word in which case it can be deduced.
- tqkxzugoaupvwqr 7y ago
  Reminds me of TSB (UK bank) that asks, in addition to username and password, for three characters of a string when you sign in. Which is stupid because you can’t do it in your head easily. You actually need to see it written down somewhere when they ask for the 3rd, 11th and 15th character of that “memorable information”.

plsdonthack 7y ago

They're a three letter acronym that starts with P and ends with C.

secone 7y ago
Shoot. They are pretty open about the fact that their passwords are case insensitive. I had always hoped this was some clever implementation using multiple hashes upon password creation. Or tolower() everywhere. If it's true that they're able to read it back though, then why would they bother?
diebeforei485 7y ago
Holy smokes. See if you can get in touch with someone in the financial press (such as the Wall Street Journal).
deleted 7y ago
[deleted]
mav3rick 7y ago
Pnc ?
keenmaster 7y ago
Wow, they should know better. That’s really mediocre if true. Call the OCC consumer hotline which is listed at the following link https://www.occ.treas.gov/topics/supervision-and-examination/dispute-resolution/consumer-complaints/index-consumer-complaints.html https://www.occ.treas.gov/topics/supervision-and-examination... Tell them you’d like to file an “Official Complaint” regarding a serious cyber security issue at that bank, and to transfer you to whoever handles official consumer complaints regarding cyber security. Regulators are sensitive to the word “complaint” (specific wording matters) and typically require that complaints are stored, prioritized, and handled in a prescribed way. Ask them if they can get back to you with any resolution and leave your contact information. Update HN if you’re comfortable with that. Good luck.
dawnerd 7y ago
That's about run of the mill for them (assuming we're thinking of the same bank). I called about my mortgage and they started reading off someone else's information. They also wanted me to confirm personal information over email...
davismwfl 7y ago
Wow, not good for such a large bank. Holy crap.

netsharc 7y ago

I know a bank (I forget which, in EU) that asked me for the 3rd and 5th letter to my password when I called them. Their thinkkng was probably that way the customer support on the other end would only see 2 letters of said password.

Al-Khwarizmi 7y ago
My main bank does this all the time. To be honest, while I'm aware it's not the best of practices, I don't care much. To me, the most important thing about bank security is that if there are fraudulent operations in my account, I can call and have them undone without much fuss. In this respect, my bank has behaved well in the past when random charges from an exotic country appeared in my credit card, in fact they noticed before I did, gave me a call and everything was fixed immediately. For this reason, I think I'm OK with banks not having too strict security practices. If at some point they start being really paranoid about security, they might feel tempted to conclude that if there is fraudulent activity, it must surely be the client's fault, because their systems are unbreachable. I'd rather have the current situation in which I don't have much responsibility about security, problems happen but the bank responds.
kitd 7y ago
My UK bank has a "memorable word" which is separate from the login mechanism (which uses a physical TOTP pad). Authorising online transactions requires you to give "3rd, 6th & 10th letters" eg of your memorable word. Are you thinking of that?
alex_hitchins 7y ago
With my bank, the telephone banking password is very different from the one you use to log in.
lozenge 7y ago
This also avoids replay attacks. Unless you use a word in which case it can be deduced.
tqkxzugoaupvwqr 7y ago
Reminds me of TSB (UK bank) that asks, in addition to username and password, for three characters of a string when you sign in. Which is stupid because you can’t do it in your head easily. You actually need to see it written down somewhere when they ask for the 3rd, 11th and 15th character of that “memorable information”.