Hacker News Reader

Hacker News

Comment by Urgo | Hacker News Reader

Full thread

Urgo

If this is really happening this is a serious issue that needs to be fixed ASAP and everyone alerted..

but.. something doesn't look right here..

OP is a throwaway account created today, which I can understand for this type of thing.. but...

they withheld the bank name in the title/desc.. okay again a responsible thing to do.. but...

when asked what the bank name was in the comments they were not shy at naming it..

Something just doesn't feel right. Why the sudden change of heart?

For everyone's sake I hope I'm right, that this is just FUD.. to the OP if you really are serious I'm sorry, and please do report this ASAP.

View on HN

Unfortunately I'm not awake at all hours of the day to respond to internet comments. But if you want further evidence that their passwords are indeed stored in plaintext, consider that their password rule prohibits the special characters !, /, \, <, >, etc. You can verify that yourself.

This is weak evidence as these rules could be implemented at the point of new password entry, prior to encryption/storage.

I once used a small DNS hosting provider where I used a password ending in '!!'. I was in the process of attempting to transfer the domain to another host but it was taking them days, and they communicated several times they were having odd issues specifically with my account. In that same time I was learning how to use Linux and MySQL, and ran into issues using the same password for the MySQL admin during a command line install. That's when I learned !! is short for "run last command". Took me a few more days to think maybe that's what was causing issues at the host provider, so I changed it, told them what I did, and asked to please try the transfer again, and it worked. I never got confirmation the password had anything to do with it, but I let support know my suspicions.

How is that evidence of plaintext storage?

Couldn't they do that validation before they hash the password, but still store a hash?

I'm not saying they don't store plaintext, but restricted character's are absolutely not incompatible with hashed passwords.

Reply on news.ycombinator.com