13 ms·
Is it OK to hold credit card numbers in cookies, Santander?
- andrewcooke 14y agoi guess no-one else here cares, but i had a quick look and santander.cl seems to not do this (but i just logged in and looked at cookies, which all seemed to be opaque).
- d4nt 14y agoI expect the UK online banking site is a decendant of Alliance & Leicester's site. Santander bought A&L a few years ago when they got into trouble during the credit crunch. Before then, Santander was not trading in the UK.
- dabeeeenster 14y agoIt was Abbey, no?
- ubermensche 14y agoThe site is identical in except for the name change to the previous Abbey site. (Which I have used for years) They changed the log in process to the current username/number/passcode setup about 2 years ago if I remember correctly.
- corin_ 14y agoSmall correction: they were trading in the UK, just not under the name "Santander" - they had owned Abbey (formerly Abbey National) for a few years before they bought A&L and then merged them under the new (to the UK) Santander name.
- d4nt 14y agoYou're right, they bought abbey first. Completely forget about that. It's probably a descendant of the abbey online site then.
- stuff4ben 14y agoI remember a bank I used to work at got bought out by Suntrust. After we had been migrated over, for some reason I had decided to check out the cookies they were using. Sure enough I saw my full SSN there. They don't do that now, but even as a junior developer at the time, I was pretty taken aback.
- Lockyy 14y agoCan confirm that cookies on my laptop did (don't anymore, and I won't be using their online banking anymore) contain sensitive information about my santander account that I last logged into over 24 hours ago. Going to go email them and tell them I'll be closing my account if they don't start taking their security seriously.
- zachinglis 14y agoIf you take that post at face value, it's not really going to do much. Sounds like the guy was on at them for a while.
- Lockyy 14y agoIt's not just this alone that's pushing me away from them, I don't like them much anyway. Their security practices for online banking are pathetic in comparison to HSBC. HSBC gave me a one time key dongle which breeds more confidence than the various articles about santander's lax security I've read.
- SpoonMeiser 14y agoHSBC are also (or at least were very recently) in the habit of calling customers and launching immediately into security questions without even identifying themselves first, which is wrong for all sorts of reasons.
- SideburnsOfDoom 14y agoI can confirm that First Direct (a subsidiary of HSBC) would also do this. The caller would say "I'm calling from First Direct" and then get confused when I asked for proof of this.
- SpoonMeiser 14y agoI like the Barclaycard (I think) fraud thing. You get called by a computer that asks you to identify yourself by picking a piece of personal information from a list. It might ask for the month and date of your birth, for example, and give you 5 options. Because there are 365 possible month + date combinations, and yours appears in the list, you know they already have this information so you're safe to confirm it, and they also get to confirm that you are (likely) who they're intending to talk to.
- UnoriginalGuy 14y agoI actually quit Santander(UK) because of their security policies. They essentially changed online banking so you had to give them a mobile number and then had to get a code from a text message they sent you to login. My question to them was "what happens if I don't have a mobile phone?" and "What do I do when I am on holiday abroad?" and their responses were (paraphrasing) "You won't be able to use online banking at all in either of those cases." In order to just get this response I got transferred between like four or five different customer service reps. So I quit my bank of like ten years and when I quit they didn't even care enough to ask my WHY I was quitting.
- kule 14y agoFunny I actually prefer their system of texting to confirm new payees (on business banking it's only to setup new payees not ones you've used before). I almost always have my mobile handy, even abroad, however trying to find & use that darn HSBC dongle every time I want to login or add a payee drives me nuts. I can certainly understand that it's a bit silly if they don't have a workaround for when you don't have a mobile though.
- eLobato 14y agoYou can still receive texts when you're abroad for free from your bank (I rely on this..) . As for not having a cellphone.. I'm kinda puzzled they didn't give you other option.
- darkhorn 14y agoIn Turkey all the banks are required to use SMS validation while logging in, by law. You can receive SMS for free while you are abroad. You can use Skype or Google Voice, but yeah I know it is more expensive.
- advisedwang 14y agoConfirmed for my santander account. I have not got a credit card, but the NewUniversalCookie cookie does contain my passcode (in all caps, just discovered it is case insensative!). The data is not just one base64 chunk, but multiple space separated chunks that base64 -d chokes on after a bit. I am probably missing a step.
- ed209 14y agowowzer. I just checked for my business account with santander and found my password as you mention. Edit: although when you get logged out for inactivity or you click log out it seems to get rid of this cookie.
- TomGullen 14y agoWhat sort of clowns stored the credit card number in a cookie? Seriously? What a breathtakingly stupid show of total incompetence. Was considering switching my personal account to Santander, have been looking to move away from Natwest for a while now. Natwest are a dismal failure of a bank to the extent I'm always happy to go out my way and dissuade people from associating with them in any way. I'll be writing Santander off my list for sure now. How on earth can you trust them after seeing this? For a business who HAS to take security seriously, for a business with a LOT of resources, for a business who hold YOUR cash this is utterly pathetic and inexcusable on their part. Leaving them might be a good idea for your personal security, unfortunately the UK is a little short of good banks. Would love to see someone shake up banking like Stripe has shaken up online payments.
- lmm 14y agoFirst Direct consistently scores highly on customer service, you might want to try them.
- pornel 14y agoTheir online banking interface is a bit old and crummy. I don't believe they take security seriously either. They force a 640px popup window that deliberately hides addressbar, so you can't easily check if it's HTTPS. My browser warns me that their site still has SSL renegotiation vulnerability unpatched.
- joeconway 14y agoFor anyone interested, if you want to see the information it is storing then take the NewUniversalCookie and seperate it by the #'s then you can see two base64 strings which are easily decoded The scary part is that the 'alias' id is actually one of the 2 passwords needed to log into the account. So in fact if someone had that and my card number all they would need is the 5 digit numerical code to log in
- iaskwhy 14y agoSlightly on-topic. I have been trying with some banks in the UK trying to find the best online banking system and I am not happy with the results so far. HSBC works quite well but the login system (with a RSA key) is annoying. I can accept it for actions like transfers but most times I just login to check my balance and transactions, requiring a token seems to much for me. Their design, even if not great, works. MetroBank seems great from the outside but their system has some issues. First, to login you need your account number, a password and three digits from a 8 digits PIN. After logging in, you can do everything without any other measure. The systems fails to login most times unless you realise you can just click on the link in the error message and logged in you are. A friend told me to use the incognito mode in Chrome and it seems to fix this issue, probably with sessions. Their design is not the best. On the transactionspage you can only see 3 or 4 transactions on the screen at a time (without scrolling, that is). I am waiting to try Santander (which I will avoid now) and Northern Rock. Any good experiences?
- mietek 14y agoFirstDirect is better than HSBC, while still being part of the HSBC group. Their phone service is a lot better, with lower time-to-human, and Scottish accents instead of Indian ones. Their web usability is still pretty bad, though. There's no ridiculous calculator-shaped hardware token. To log in, FD requires 3 characters from your password, and a "secret answer" — effectively, another password. Infuriatingly, they disable the Enter key in the log in form, so a mouse click is necessary. FD's web UI is stuck firmly in the 90s, with nested menus, cramped screens, and plentiful transitions. Even the log out button redirects to another screen, in order to ask for confirmation. Finally, FD give you £100 as an incentive to switch, and an additional £100 if you switch back out.
- raverbashing 14y agoErm, I can login into my HSBC bank account (to check balance, etc) with 3 chars from my password I just need the token if I'm doing 'something' with money And no Indian accent on phone service Another bank I know uses your card as a token, requiring you to have your card + a card reader. Better in some aspects, worse in others.
- catshirt 14y agofor what it's worth, i use sovereign bank who was recently acquired by santander. the sovereign online banking contains the NewUniversalCookie, which contains an XML document (LOL) with 3 nodes: name, username, and userID. seemingly no intensely sensitive data in my cookies, but also seems to be some crossover with Santander's security system.
- btown 14y agoI've seen error messages in Spanish, which would seem to indicate (since Sovereign was originally a New England-based company) that some backend services are shared. Luckily, I barely use the account, and I will continue to do so now that this post has come to light.
- reidrac 14y agoYep, checked the Spanish Santander online services and I couldn't reproduce the problem described here. I got the XML with an userID field, but that's all. Also the cookie was removed when I logged out. Seems fine to me.
- Major_Grooves 14y agoWhat's really annoyed me about Santander's website is when you click 'log-out' you might think you have logged out - but no - you are taken to the 'are you sure you want to log-out' page. With banking websites I just want to click that link and be sure I am logged out. I don't mind logging in again if I clicked by accident.
- michaelfeathers 14y agoI don't bank with Santander, but I was in Barcelona a few weeks ago and I passed by a Santander ATM that was rebooting IBM OS/2 Warp.
- SethMurphy 14y agoIBM OS/2 warp is still a very viable solution for always on terminals and is more common than you may realize. While not officially supported anymore, for a price IBM will still support it. While I wouldn't choose it for a new solution, I wouldn't run out and create new ATM software, if it is working well, just because of the OS. Would you be more comfortable if they were running windows?
- jbester 14y agoIt's been rebranded ecomstation and it's sold through another vendor now.
- michaelfeathers 14y agoI was actually more surprised to see a reboot on a customer-facing ATM screen. I don't think I've seen that in the US. Maybe I lead a sheltered life.
- chubbard 14y agoOr maybe you just don't frequent ATMs a lot. I've definitely seen OS/2 Warp reboot screens on ATMs in the US.
- reidrac 14y agoSame name, but different banks. I don't think Santander (the Spanish bank) changed all systems of Santander UK (formerly known as Abbey) so your experience with a Santander ATM in Barcelona is probably irrelevant. EDIT: typo
- reidrac 14y agoI was wrong. It looks like they share code in their on line services.
- chubbard 14y agoThese hacks better be glad this industry isn't regulated like other professions where the individual professional is liable for his work. If these developers were doctors or engineers they personally would be liable for damages. Right now we have laid blame at the feet of the company, but this company doesn't seem to understand they don't have the technical know how to be building websites for their customer base.
- readme 14y agoPlease don't give the government ideas
- chubbard 14y agoWell it might not be your government that institutes this idea. Given this is a bank in the UK you or I might not be allowed to vote on this type of thing, but if general populous begins to see the choice of technical decisions are more in the hands of the professionals and not so much the company it could very well change. And it might be companies that push legislation like this if they feel they don't want to bear the legal risk. Now usually there is professional insurance that consulting companies have to purchase for liabilities just like this. If you are consulting firm implementing systems for banks they will require you carry $2 millions/dev of insurance should there be a screw up like this. Maybe this is the best option because I'm not exactly behind supporting measures to certify or regulate our industry, but I fear bad behavior like this might force it. This is a hack rookie mistake. I'm fully aware of the ramifications of doing something like this, but I'm not immune to mistakes that could result in the same damage. However, a law like this would treat me the same way as these hacks.
- delinka 14y agoThe company certainly should be responsible. The alternative (which I'd say would be good for us seasoned software professionals, bad for the companies, and not very good for the indie software profession) is Computer Software Creators get their own professional, gov't-approved certifications, a large pay increase to go with the risk increase, and a legal requirement for these businesses to only hire certified Computer Software Creators. Ain't capitalism grand?
- fmavituna 14y agoFrom a practical attack point of view: 1. As explained in the original email XSS attacks now lead CC exposure, very bad 2. If the cookies are not session cookies. It's horrible, then anyone who got access to that computer later can read the cookies and Credit Card. But also don't forget tons of websites still keeps auto-complete enabled!!!! in freaking CC fields. 3. If the cookies are not marked as "secure" (or issued over HTTPS) then it's totally messed up and invalidates PCI etc. directly. Now your credit card transmitted over HTTP. 4. Other than this even though it's rather pointless thing to do, there is not any more direct attack I can think of. Put it this way, this is not worse than a XSS vulnerability in a website as an XSS can lead more serious issues directly.
- chris_wot 14y agoWell someone has badly violated PCI-DSS 2.0. This is bad in such an amazingly awful way on a "secure" banking website that I'm surprised that this bank even has an IT team, let alone a development team! How did this not get picked up in QA testing, or even in a cursory audit?!?
- martokus 14y agoI wonder what is the PCI DSS audit committee doing? I mean the world is fool of idiots that need policing and that's why such organs exists at a first place. Shit like this just shows that being a PCI DSS level 1 certified means absolutely nothing in the real world.
- chris_wot 14y agoYou got that right. Most IT shops I've noticed (at least in Australia) used to ask software vendors if their software was "PCI-DSS 2.0 compliant". Stupid thing to ask. The only key things a software vendor can really answer is that they don't store credit cards in their database, or if they do then they don't display them to anyone. Everything else (well, almost everything else) can be dealt with on the infrastructure side of the equation.
- aneth4 14y ago> I wonder what is the PCI DSS audit committee doing? Creating a racket. PCI is designed to control merchants and extract money, not for security.
- chris_wot 14y agoI have to disagree with you most emphatically. PCI DSS was a response to a very bad issue, which was and is credit card fraud. If you look at the DSS, it's eminently sensible and in fact if you implement it properly you will most definitely have a secure environment for credit card transactions. If you do not follow it, then you are leaving yourself at significant risk to be being breached and credit card data being stolen. I'm curious though: what part of the PCI-DSS merely creates "a racket", and what parts "extract money"?
- northband 14y agoHoly cow!
- gambiting 14y agoSantander ALSO stores your passwords in plaintext, or at least has access to them in that form. My password used to include special characters, until a transfer to their new web interface year ago. After they did it,I could not log into my account - it kept telling me that my password was incorrect. So I rang them up,and a lady on the phone asked,if I had any special characters in my password. I said yes - and then she told me to try logging in without them,as the new system does not accept them and they were automatically stripped during the transition to new interface. At first I was like - ok, at least now I can log into my account. But then it hit me - how the holy fuck could they remove special characters from my password???? The only way they could do that is if they had access to its plaintext, which is completely unacceptable. I complained to Santander about it,only to receive a letter stating that they appreciate my concerns but their system is safe. I've got all the correspondence with them if anybody wants to see.
- ookware 14y agoI believe NatWest and Halifax must do the same as they both ask you to "input characters x, y and z from your password" which I don't see how they could do without needing plain text storage. Of course I await being told how I am wrong with this!
- pja 14y agoYup. Logging in to NatWest requires that you know your customer number, 3 numbers from a login PIN and 3 letters from a password. They do use 2-factor authorisation for any new payees, so it's not totally insecure. On the other hand, their recent 'get cash from the nearest ATM with a code we send to your phone if you've lost your wallet' app was soundly compromised by criminal gangs within days, and the service had to be pulled entirely. They're still advertising it on the homepage, but when you click through it says "We're sorry. Get Cash is not available at the moment. We are currently updating this service to increase the level of security around it." Reading the blurb for the Get Cash service made a likely compromise route immediately obvious to me: it seems very likely that anyone who's had sight of your debit card could register an arbitrary phone & extract cash from your account, because the only details needed to verify your phone were on the card, or easily guessable (NatWest customer numbers are extremely predictable unfortunately). If there was anyone obviously better I'd be dumping NatWest, but it's not obvious that any of the other major banks are much of an improvement :(
- DanBC 14y agoI'm curious about responsible disclosure. WhiteHat finds a security vulnerability. They tell the company. But, with banks, it's pretty hard to find the right person to tell. What steps should WhiteHat take to satisfy responsible disclosure? Just a printed letter to banks registered address is enough? (Banks, and everyone really, should have a "please use this address for responsible disclosure" - that would reassure me as a customer that they are taking security seriously). But then, in England, we have a potential further step with the regulatory bodies. There's the ICO (information commissioner's office) who are overworked and will do nothing about this. And then there are the card companies who will, I'd have thought, be keen to protect their customers from fraud. Would responsible disclosure include a step to involve these third parties, if only to provide some clue pressure to the insecure site?
- danielweber 14y agoSometimes the media can help. If you have a contact, they can put pressure on the company by calling them to interview about the vulnerability they are going to write a story on. Back when I used to read the disclosure lists, I'd see people ask "I need a security contact as XYZ Inc." all the time.
- victorantos 14y agoI've been today to Santander, and they told the only way for me to put money in my account is by using their online service. This is because I have an eSaving account type...
- nathan_long 14y agoOn top of all the other issues, add the fact that some browsers no longer delete sessions cookies when you close the browser. Notably, Chrome and Firefox. http://dalevisser.wordpress.com/2012/07/18/how-to-fix-firefox-and-chrome-default-of-retaining-session-cookies-insecurely/ http://dalevisser.wordpress.com/2012/07/18/how-to-fix-firefo...
- Evbn 14y agoHoly wow. I expect that from Chrome, which is basically spyware, but not from Firefox.
- timothya 14y agoReally? Wow, I'm surprised to see someone with that sort of attitude. What makes you say that Chrome is spyware?
- reidrac 14y agoI don't use Chrome myself, I use Chromium for testing when doing web development. Apparently you can't get the exact Chrome binary form Chromium source code, so I don't know if there are remarkable differences... but I find these quite amusing: http://i.imgur.com/Mq3pH.png http://i.imgur.com/Mq3pH.png It is correct that these options are in "Privacy". The good thing is that you don't need to worry about tracking cookies because your browser is already tracking you ;) (I'm half joking / half serious here; this is off-topic anyway)
- sw007 14y agoSlightly off topic but I bank with Natwest.com and I have gone to their homepage today and am AMAZED as to what I saw. If you navigate to their homepage - in prime view you'll see a section that says: "Great ideas come from great conversations" Under this is feedback from customer - 90% of the feedback is incredibly negative. For example: ""Tell your customers the truth how bad a silver account is. Premium numbers to contact and register, cannot register mobiles for ..." "Natwest is an embarassment, you have lost a customer for life". This just sums up how out of touch banks are today with the internet. Don't advertise this sort of feedback! Especially on a homepage! What are they thinking?
- marshray 14y agoHow often do happy customers leave positive feedback compared to unhappy ones? Sounds like they're pretty brave to me :-)
- _pferreir_ 14y agoI bet they have a padlock icon somewhere? No really, whenever I think there is no display of utter incompetence in software systems programming that will surprise me, here's another big name, ready to make standards sink to a new low. I wonder who and how much they paid for such a nicely done job.
- dreamdu5t 14y agoI don't see what's much different about this than Stripe giving you a token for the customer/card and storing it in a cookie.
- deleted 14y ago[deleted]
- deleted 14y ago[deleted]
- SeanDav 14y agoA huge irony in all this is that Santander pulled out of a deal to buy a large number of branch offices from a rival bank because apparently the computer systems of this rival bank weren't up to scratch and merging would have been an issue. This bank probably didn't believe in storing sensitive information in publically accessible places clearly /sarcasm
- phragg 14y agoHere in the states, MA, I use Sovereign Bank who had just got acquired by Santander. I was able to reproduce the NewUniversalCookie which showed my `username` and `userid`. I'm a rather young adult (22) and had used Sovereign solely because my parents had used it, but now I'll be happily moving elsewhere.
- Tloewald 14y agoBetteridge's law? Given the recent IEEE clear text passwords stored on an FTP server fiasco we need to transition from shock and outrage and switch to resignation and ennui.