Hacker News Reader

I won't go into the idiocies banks implement. They usually have to because totally incompetent people tell them they have to.

One of the practices was pathetic to the point of being funny: you had to input specific characters of your password (2nd, 4th, 6th, etc - this was changing at each login) AND there was a short timeout. My children probably learned a few new words when I was logging in.

View on HN

I suppose the purpose of that was to signal to hackers that they ARE in fact storing all passwords in plaintext?

It is very likely, yes. After a year or so of this practice (people were writing down their password with digits under the letters to quickly match the request) the bank said that they now propose two "secure login forms" - the older one and a new, normal one.

Some time later they silently removed the first one.

Tsb bank in the UK still do exactly this

Reply on news.ycombinator.com