Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by jeremyt | Hacker News Reader

Full thread

jeremyt·

I wrote this a couple years ago about Schwab's embarrasing security. Most of the issues are still there.

https://jeremytunnell.com/2014/12/22/swab-password-policies-...

View on HN

FYI,

Password + token is a common pattern in systems where hardware/software/OTP tokens were bolted on after the fact.

Not just that, but on certain systems (think a Windows login screen, or a POP3/IMAP login for your e-mail client), you can't have a 3rd "token" field -- they're hardcoded to ask for just a username and password.

So vendors came up with the idea of appending the token value onto the password, and their middleware (say, a PAM module) splits the provided value into password and token and validates both.

EDIT: That's not to say that Schwab is doing it right (in the front-end, seriously???), but just pointing it it's not as uncommon as you think.

RADIUS backend to network equipment as well. Since RADIUS is old, it doesn't have great password hash/encryption support (afaik), so you don't use it over open networks already, and it's well entrenched / widely supported.

So have it with no encryption, and the back-end can pull the password and 2FA code apart and verify both of them, for all kinds of systems which have only a username/password prompt for logins.

Wow, how has this not gotten more attention?

It has. It's just been like that for years.

Are most of these actually still there? The password requirements have changed dramatically in the last 6 months.

Well if true, I stand corrected. I have received no communication from Schwab about any changes. I assume that if they had made stronger passwords available, for example, they would notify their customers.

I no longer hold any assets at Schwab, but I do poke around every now and then, and it's possible they changed things without me noticing.

Reply on news.ycombinator.com