Hacker News Reader

Comment by signal11 | Hacker News Reader

HSBC doesn't do that any more for me -- they've moved to a Google Authenticator-like 2FA approach[1], but Lloyds[2] does - they have one username and password, and a "memorable phrase" which they clearly store as plaintext because ask for the xth, yth and zth character as a secondary security measure. Lloyds tech folk reading this -- please consider fixing this.

[1] http://i.imgur.com/QCGPDWz.png [2] http://i.imgur.com/VdtGC4T.png

View on HN

Why cant they just also hash those three letter combinations they ask you? Not nearly as secure but I see many people saying that the plaintext must be stored to achieve this, and all I am thinking is that it would require you to store multiple hashes for each user, each a portion of their password.

Still a lot easier to guess a portion of a password than a password, but it doesnt follow in my mind that it is definitely in plaintext.

Three letter hash combinations and single letter hashes would all be essentially plaintext. The security of a hashed password comes from the fact that the password comes from a field of 2^(# of bits) possible values (with more useful bits the more types of "characters" allowed). If you only have a few characters that is so easily crackable (by brute force of every letter or three letter combination) that it might as well be plaintext. It is a security failure if they can get at some of the characters in a password.

However this is a memorable phrase (not password), similar to a security question. These are not generally hashed because customer service uses them to confirm authorization to reset a password.

It would be absolutely trivial to enumerate all possible three-letter combinations and hash them. That's no better than storing in plaintext.

HSBC always used a token for online banking you can either order a secure Key or for the past year or so use a mobile authenticator.

The "password/memorable phrase" is only used as a secondary authentication measure and in order to initiate a token recovery procedure on the site.

P.S. I still use the physical OTP token, just got a new one last month it's a Vasco Digitpass 270 supports upto 8 digit pins and it locks out automatically after IIRC 5 attempts.

I don't recommend using a phone authenticator for the sole reason that losing a phone is annoying enough on it's own you don't want to lose your bank account access too :)

Authy addresses the losing your phone scenario.

Edit: I realise you're probably referring to proprietary bank authenticator apps

Yes they do so do quite a few others, but this is about the HSBC authenticator :P

Same for Natwest, but this does not mean they store it in plain-text.

I have the memorable phrase and have to use the HSBC app for my password. Now, the fun thing is that my actual HSBC password is 40 characters randomness, so pretty secure. The mobile password that is used to derive the 2FA key must not be longer than 8 characters. So essentially I traded a long and secure password for an 8 character password.

I really really dislike HSBCs online banking as a whole, the password system plus the constant “We encountered an error, please try again later” messages.

Plus the unintuitive navigation, the ridiculous over-skeuomorphism of 'past statements', and the insanely-low, seemingly non-configurable session timeout. At least you can finally use a payment reference > 10 characters, but HSBC's online banking is still stuck in the stone-age overall.

I do not agree that they store a password in plain text. You cannot say for sure. What if they hash each character and store each with its position in the db?

That wouldnbe still pain text actually, because it's easy to have a table for hash -> char. Chararcters being limited by their numbers.

Fine. Refer to my detailed answer below that shows longer hashing difficult to bruteforce.

I don't find your other answer. But, basically if you hash one character, there is only ~ 255 possibities (a-zA-Z0-9 plus some special chars). So, a 10 characters password is only ~ 2,500 hash to compute and that's nothing. Might as well store it in plaintext, because it in fact is.

Reply on news.ycombinator.com