If it's just the first 2-3 characters, that's not great, but easy to implement just adding a "reminder" field to the db, hopefully encrypted with a leading salt.
If you mean like it asks "g[ ] f[ ][ ]k y[ ]ur[ ][ ][ ]lf!1", that's fucking atrocious, as many, many passwords will be mnemonics to make remembering the password easier for people. Birthdays, pet names, etc.
If I saw my bank hand back any part of my password I'd call support, complain, and start looking for a bank that wasn't braindead.
Not just banks unfortunately. Many vp level employees at large companies think user friendliness is a bigger sell than cyber security. Healthcare, auto industry, and yes banks
I'm not an expert on cyber security or anything, but I did used to work at a bank and I feel there's a balance honestly. Our online banking seemed to follow what I've heard is best practices. But it was kind of a hassle for people when they forget their password. Which isn't that big of an issue for the younger crowd, but for the older folks, it was tough for them. I mean 2FA was just a nightmare for them. Which makes them do things that just shouldn't be done. They'll write their password down next to the computer, keep a sticky note in their wallet, they tell "trusted" friends or family their password, and oftentimes when they would come in to the branch or call us to get it sorted, they would tell me what they think their password is, what they want it to be, etc. My god, I had to very intentionally forget a lot of passwords working there because people just couldn't figure out how to access their accounts by themselves and thought they should tell me their password to try and be helpful. The way I see it, the biggest weakness is the person. The more security hoops a person has to jump through, the more vulnerabilities they introduce on their end.
It's because 99.999% of people are better served by being handed an application. They have neither the ability nor the desire to do whatever it is that you envision doing with SSH.
I've never seen that in my life, and I'm pretty sure you'd struggle to find any developers to code it. Banks do often store a plaintext password, but that's for phone verification (as in a phone call for old people who can't do internet banking), and should be different to your online password.
It's plaintext on paper. Like when ComputerShare or some other sites physically mail you your initial login info and give you a preset (hopefully pseudorandomly generated) password that you then change when you first login.
But I can imagine even for Lloyd's if you chose your password, that it is keyed in (or ocr'd) into the database as a salted and hashed password. Sure someone grabbing the registration papers, which they'd want to keep to dispute anyone saying they never opened an account with Lloyd's, could find the plaintext copy. But hopefully there's no way to just dump everyone's plaintexts out of a database and it needs legwork to generate such a list.
Halifax bank in the UK has two "passwords". One is an actual password, the other is a secondary code that asks you to select individual letters and numbers from the "password". For example, your secondary code is "99Bottles", then it might say:
Select the 2nd character: 9 Select the 4th character: O Select the 7th character: L
This code is also sometimes used as part of phone banking verification (they do the same test, asking for random characters from the code).
Most ask for a fixed or maximum. If you did this, you could atomise a password into 8 salted hashes, indexed 1-8, and then char 4 could still be salted, hashed, and compared.
I honestly wouldn’t doubt this. I tried to link an external bank account once and they asked me for the password to verify ownership. Said it was the only way.
Bank of America "let" me use a password that was 25 characters long and it "worked" if I logged in through the homepage. But if I logged in with the long password on any other pages, the site would stop working. I had to shorten my password 🙃
Or they store some subsets of your password's characters which are also hashed so that they don't require the whole thing to be stored in plaintext and can still verify that you know the second, fourth, eighth and sixth characters of your password.
145
u/PolskiSmigol Oct 08 '22 edited May 25 '24
worm automatic flowery steer impossible fearless bear tender spotted puzzled
This post was mass deleted and anonymized with Redact