3 ms·

Hashing passwords has been ingrained into our brains as it's an easy way to reduce risk. That said, sometimes sensitive information needs to be stored in a retr

Hashing passwords has been ingrained into our brains as it's an easy way to reduce risk. That said, sometimes sensitive information needs to be stored in a retrievable format (subscription credit card processing comes to mind). Every data decision that's made has an element of risk involved while accomplishing an end goal. With the right processes in place (encryption, limiting access (auditing that access), decryption authorization), the risk can be reduced to an acceptable level. I don't think we have enough knowledge of the risk and processes in place at this bank to say if it's an issue.

coenhyde 7y ago
I think you're prematurely jumping to the defense of this bank. What we do know is that the customer service rep was able to read the user's password in plaintext. Even if there is a "legitimate" reason for storing in a retrievable format (probably due to compatibility with legacy systems) the fact that the customer service rep could access that password tells me they do not have appropriate access control.
- bodhi_mind 7y ago
  Just to play devil's advocate: What is a secure hypothetical way of granting access to an account when the customer lost access to their email and phone (so no pw reset or 2 factor authentication will work)? The bank has to have other processes in place. They're not going to keep your money from you. Let's say they accept a driver's license as authentication or a debit card. These methods are way less secure than a secret password and possibly introduce more security risk than a rep having access to view a password. A bad actor rep could then [almost] just as easily get a fake ID created to get the same access the password would have granted. I'm also assuming that the password was completely visible, not just a truncated version. This is the root of my concern of not knowing all the risks and processes involved. I don't want to jump to conclusions without knowing the whole ecosystem.
cranium 7y ago
A password should be considered a user secret and never be available in readable form by anyone in the company. Here, instead of having a rep reading out loud the password, they should have done a password reset or something with the same effect. And let's not kid ourselves: if passwords are accessible in readable form they are eventually going to be read and used by someone ill-intentioned. There is no reason to have passwords in plain text, period.
_-david-_ 7y ago
Can you name a single reason for having a password in a retrievable format? Credit cards, account numbers, etc need to be retrieved so it makes since to not hash them. Passwords on the other hand should only be known by you so there doesn't seem to be any reason to have a retrievable format for them.

coenhyde 7y ago

I think you're prematurely jumping to the defense of this bank. What we do know is that the customer service rep was able to read the user's password in plaintext. Even if there is a "legitimate" reason for storing in a retrievable format (probably due to compatibility with legacy systems) the fact that the customer service rep could access that password tells me they do not have appropriate access control.

bodhi_mind 7y ago
Just to play devil's advocate: What is a secure hypothetical way of granting access to an account when the customer lost access to their email and phone (so no pw reset or 2 factor authentication will work)? The bank has to have other processes in place. They're not going to keep your money from you. Let's say they accept a driver's license as authentication or a debit card. These methods are way less secure than a secret password and possibly introduce more security risk than a rep having access to view a password. A bad actor rep could then [almost] just as easily get a fake ID created to get the same access the password would have granted. I'm also assuming that the password was completely visible, not just a truncated version. This is the root of my concern of not knowing all the risks and processes involved. I don't want to jump to conclusions without knowing the whole ecosystem.

cranium 7y ago

A password should be considered a user secret and never be available in readable form by anyone in the company. Here, instead of having a rep reading out loud the password, they should have done a password reset or something with the same effect. And let's not kid ourselves: if passwords are accessible in readable form they are eventually going to be read and used by someone ill-intentioned. There is no reason to have passwords in plain text, period.

_-david-_ 7y ago

Can you name a single reason for having a password in a retrievable format? Credit cards, account numbers, etc need to be retrieved so it makes since to not hash them. Passwords on the other hand should only be known by you so there doesn't seem to be any reason to have a retrievable format for them.