Thread

<input type="password" maxlength="20"> prevents me from logging into Vanguard

66 points · 99 comments · tanin

walrus01 · 1790984761 · focus · HN ↗
Until just 8 years ago one of the major Canadian nationwide banks was provably storing peoples' online banking logins in plaintext in some ancient mainframe database system. If you got to a sufficiently high level of customer service people in an account recovery process (like executor/probate process for the deceased) they could literally read back to you the entire password letter for letter.
And just ten years ago BMO required passwords to be exactly 6 char, no more, no less: <a href="https://www.reddit.com/r/PersonalFinanceCanada/comments/4t0mlk/bmo_only_allows_6_character_passwords_for_its/" rel="nofollow">https://www.reddit.com/r/PersonalFinanceCanada/comments/4t0m...
For the Americans who might not be aware of what BMO is (it's not some podunk small town bank): <a href="https://en.wikipedia.org/wiki/Bank_of_Montreal" rel="nofollow">https://en.wikipedia.org/wiki/Bank_of_Montreal
1. andrewstuart2 · 1790984914 · focus · HN ↗
  I mean that could still be encrypted. But passwords should never be reversible. It should be hashed with scrypt or apparently now Argon2id.
  1. walrus01 · 1790985002 · focus · HN ↗
    I mean literally like if the person's password was "potato##!" the customer service person would read back "potato##!". They weren't reading the encrypted contents of a pw field.
    UqWBcuFx6NV4r · 1790985503 · focus · HN ↗
    That doesn’t mean that it is stored as plain text. It just means that it isn’t hashed.
    I agree that it any system that allows this IS almost certainly just storing as plain text, and that it’s bad regardless.
    unsnap_biceps · 1790985553 · focus · HN ↗
    their point is it could have been stored encrypted and then decrypted for the customer service person to read back to you. Access to plain text != storing it as plain text.
    Atheros · 1791010816 · focus · HN ↗
    The only way three people can keep a secret is if two of them are dead.
    If the data can be read by so many people in the company that even the customer service people have access, it's functionally not encrypted.
    unsnap_biceps · 1791039369 · focus · HN ↗
    I don't disagree with you, however the original claim of
    > provably storing peoples' online banking logins in plaintext in some ancient mainframe database system
    Is not about functional encryption but storing directly as plain text.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.