Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by _Understated_ | Hacker News Reader

Full thread

_Understated_·

Why not reach out to someone like Brian Krebs? He has a pretty large reach and can potentially make people take notice.

Try @briankrebs on Twitter.

View on HN

Alternatively I feel like Troy Hunt may also be able to help

https://twitter.com/troyhunt

He runs the @haveibeenpwned service

Troy has actually covered a similar topic to this in the past:

https://www.troyhunt.com/banks-arbitrary-password-restrictio...

His viewpoint seems to be that poor security practices around passwords in banks are not a big deal, due to the overall processes that banks use to prevent fraud.

I would tend to agree, for now, except that banks are doing their best to shunt responsibility for fraud onto merchants and customers. There are obvious financial incentives that will encourage them to continue trying to do so.

Troy is usually reeeaaally busy and he may not have time to jump on this one case.

There's a blog specifically dedicated to highlighting examples of plain text storage of passwords too: https://plaintextoffenders.com/

This is the best way to go about it if people at the bank aren’t responding. Nobody likes a PR nightmare, and Brian Krebs can handle this better with the right people if the OP provides enough evidence.

"Almost without fail at each engagement multiple C-level folks will approach after my talk, hand me their business cards and say something like, “I hope you never have to use this, but if you do please call me first.”"

https://krebsonsecurity.com/2019/12/ciso-magazine-honors-kre...

Reply on news.ycombinator.com