3 ms·

"First, the finserv organizations we've worked with tend not to store plaintext passwords." I am talking about retail banking, specifically those with telephon

by sho 18y ago

"First, the finserv organizations we've worked with tend not to store plaintext passwords." I am talking about retail banking, specifically those with telephone service. If they don't store in a recoverable form (encrypted or plaintext) then I would love to know how the telephone operators verify passwords. "Secondly, the difference between sending the password and the reset link in email is that the former compromises every other app the user uses." Sorry, I don't understand the meaning of this sentence. Anyway, I wasn't really serious with the "password recovery by email" argument, I was just trying to come up with a list of reasons an org might want to store plaintext, but that was probably a pretty flaky one. Any site that sent me my password in plaintext via unencrypted mail would lose me as a customer pretty damn quickly, too.

tptacek 18y ago
Done quite a bit of retail banking work. Stored plaintext passwords? A doc-able finding.
- sho 18y ago
  I meant encrypted for banking, of course. The key point being that the passwords are readable. Two-way, vs the one-way hash discussed before. Maybe I didn't explain myself properly. Web site passwords might be one-way hashed, I don't know, but telephone banking passwords must be displayed on screen for the operator to read.
  - tptacek 18y ago
    In one of the 5 largest retail banking operations in the US? Use of HTTP Auth --- digest or otherwise --- at all --- a doc-able finding.
    - sho 18y ago
      "Use of HTTP Auth --- digest or otherwise --- at all --- a doc-able finding." Uh-huh. So, your photocopiers have SSL certs do they? More likely they have nothing at all. I wonder if that's a "doc-able finding", whatever that is, presumably something bad. This obsession with HTTP Auth being "evil" is laughable. A lot of the time it's absolutely fine. Hell, a lot of the time it's overkill. And that rule, if true, is a Dilbert-esque joke. You can't legislate security by banning arbitrary protocols like that. Yes SSL is more secure but other methodologies are still useful, used appropriately. It's like the army banning pistols because machine guns are "better".

by sho 18y ago

tptacek 18y ago

Done quite a bit of retail banking work. Stored plaintext passwords? A doc-able finding.

sho 18y ago
I meant encrypted for banking, of course. The key point being that the passwords are readable. Two-way, vs the one-way hash discussed before. Maybe I didn't explain myself properly. Web site passwords might be one-way hashed, I don't know, but telephone banking passwords must be displayed on screen for the operator to read.
- tptacek 18y ago
  In one of the 5 largest retail banking operations in the US? Use of HTTP Auth --- digest or otherwise --- at all --- a doc-able finding.
  - sho 18y ago
    "Use of HTTP Auth --- digest or otherwise --- at all --- a doc-able finding." Uh-huh. So, your photocopiers have SSL certs do they? More likely they have nothing at all. I wonder if that's a "doc-able finding", whatever that is, presumably something bad. This obsession with HTTP Auth being "evil" is laughable. A lot of the time it's absolutely fine. Hell, a lot of the time it's overkill. And that rule, if true, is a Dilbert-esque joke. You can't legislate security by banning arbitrary protocols like that. Yes SSL is more secure but other methodologies are still useful, used appropriately. It's like the army banning pistols because machine guns are "better".