3 ms·

You should report to proper authorities about the severity of the issue. Reach out to their security or technical higher up department of the bank. In your cas

You should report to proper authorities about the severity of the issue. Reach out to their security or technical higher up department of the bank. In your case, they may or may not be storing the password in cleartext. They might be using the two way encryption instead of one-way hash. Passwords should be hashed (with salt) and it is irreversible. For a financial institution, revealing your password by a customer service rep is a big red flag. I would reach out to concerned authorities and do a proper disclosure.

notyourday 7y ago
> You should report to proper authorities about the severity of the issue. Reach out to their security or technical higher up department of the bank. Switch your bank. Do not reach out to the bank's security/technical! There's a non-zero chance that the response from the bank would be to reach out to the FBI and claim that you are the "hacker". It will create an enormous headache for you. If you are going to reach out to anyone, reach out to the OCC.
- carapace 7y ago
  https://www.occ.treas.gov/ https://www.occ.treas.gov/ ?
  - notyourday 7y ago
    Yes
- rasikjain 7y ago
  Thanks for clarification. Wasn't aware of OCC.
- pc86 7y ago
  Does storing passwords using two-way encryption violate some OCC regulation?
  - notyourday 7y ago
    It is about what you are optimizing for. You, a customer, notifying a bank would probably do nothing. You, a bank customer, filing a formal complaint with a banking regulator triggers procedures to handle it that a regulator has which in turn triggers handling procedures that a bank has. You do not complain that the bank stores passwords in cleartext. Instead you complain that the bank does not adequately safeguard information needed to access your account from the third parties with the example being the customer service agent being able to see not only your ID ( which they can and need to do their job ) but also your password ( which they do not need to access ). So not only the customer service agent can access your account while on-duty in the call center via a special system but also can either themselves or via another party access the bank account as if it were you.
AndyMcConachie 7y ago
Spoiler alert. No one in a position to care understands why this matters. Nothing gets done. Major vulnerability occurs. Customers get screwed. Some low on the totem pole techie gets blamed and loses their job. Executives get bonuses. Film at 11.

notyourday 7y ago

> You should report to proper authorities about the severity of the issue. Reach out to their security or technical higher up department of the bank. Switch your bank. Do not reach out to the bank's security/technical! There's a non-zero chance that the response from the bank would be to reach out to the FBI and claim that you are the "hacker". It will create an enormous headache for you. If you are going to reach out to anyone, reach out to the OCC.

carapace 7y ago
https://www.occ.treas.gov/ https://www.occ.treas.gov/ ?
- notyourday 7y ago
  Yes
rasikjain 7y ago
Thanks for clarification. Wasn't aware of OCC.
pc86 7y ago
Does storing passwords using two-way encryption violate some OCC regulation?
- notyourday 7y ago
  It is about what you are optimizing for. You, a customer, notifying a bank would probably do nothing. You, a bank customer, filing a formal complaint with a banking regulator triggers procedures to handle it that a regulator has which in turn triggers handling procedures that a bank has. You do not complain that the bank stores passwords in cleartext. Instead you complain that the bank does not adequately safeguard information needed to access your account from the third parties with the example being the customer service agent being able to see not only your ID ( which they can and need to do their job ) but also your password ( which they do not need to access ). So not only the customer service agent can access your account while on-duty in the call center via a special system but also can either themselves or via another party access the bank account as if it were you.

AndyMcConachie 7y ago

Spoiler alert. No one in a position to care understands why this matters. Nothing gets done. Major vulnerability occurs. Customers get screwed. Some low on the totem pole techie gets blamed and loses their job. Executives get bonuses. Film at 11.