3 ms·
Santander in the UK does this too. You can tell because they only ask for 3 characters out of your password whenever you log in. What's ironic is that whoever d
by lpilot 7y ago
Santander in the UK does this too. You can tell because they only ask for 3 characters out of your password whenever you log in. What's ironic is that whoever did that propably thought they were being super clever.
- deforciant 7y agoOther banks in UK do that as well, shouldn't they all be reported for this?
- daveoc64 7y agoTo whom, and on what basis? There is nothing in UK law that says banks have to store your passwords "securely". Issues like this have been raised in the past, and authorities like the ICO have said no law is being broken. GDPR, for example, does not specify technical mechanisms required to store any form of data.
- Recursing 7y agoSee https://news.ycombinator.com/item?id=22356101 https://news.ycombinator.com/item?id=22356101
- daveoc64 7y agoUnfortunately, they are still non-committal on what is required. They advise that passwords should be hashed, but there is nothing that makes that a binding requirement. The gist is still "do what you think is appropriate". The ICO talks about balancing risks and convenience, and the banks will argue that their systems are secure overall, and don't make the consumer liable anyway. Under the ICO's guidance, an organisation could argue that plain text (or reversibly encrypted) passwords allow them to do things like password reminders. You or I might think that's terrible, but they can argue that it's a better user experience.
- Recursing 7y agoAre you sure? What about the fines they're already giving? https://news.ycombinator.com/item?id=18531588 https://news.ycombinator.com/item?id=18531588
- daveoc64 7y agoThat's in Germany. It's up to the regulator in each country to enforce the rules. The ICO has a reputation for being toothless.
- easytiger 7y agoThe screen they are looking at isn't showing them all the numbers. Though it isn't fantastic as a security measure i admit.
- chrismatheson 7y agoIs it not possible to verify positional characters without storing in plain text ? off the top of my head, something like storing your full password salted + hashed along side each char salted + hashed.
- benmmurphy 7y agoIf you store an individual character hashed then it is trivial to brute force it. I don't think there is a bcrypt work factor that you could use that would prevent brute forcing but would allow the individual character to be used for authentication.
- mrfredward 7y agoAnd if you know the first character of a two character password, it's trivial to brute force the second, and so on...
- chrismatheson 7y agoi would definitely expect it to be less secure, but not exactly plain text?