Hacker News Reader

Comment by walrus01 | Hacker News Reader

Until just 8 years ago one of the major Canadian nationwide banks was provably storing peoples' online banking logins in plaintext in some ancient mainframe database system. If you got to a sufficiently high level of customer service people in an account recovery process (like executor/probate process for the deceased) they could literally read back to you the entire password letter for letter.

And just ten years ago BMO required passwords to be exactly 6 char, no more, no less: https://www.reddit.com/r/PersonalFinanceCanada/comments/4t0m...

For the Americans who might not be aware of what BMO is (it's not some podunk small town bank): https://en.wikipedia.org/wiki/Bank_of_Montreal

View on HN

> For the Americans who might not be aware of what BMO is

Maybe news hasn't traveled north and broadcast on the CBC, so maybe you haven't heard, but BMO has branches all over the US.

Yes, as the result of certain acquisitions, much as you can see the banks that TD acquired and rebranded particularly on the US east coast. But not everywhere and not as prevalent as like a Bank of America or Wells Fargo or Citibank. There's huge swathes of the US that have zero BMO brand name presence.

Additionally First Citizens acquired a bunch of "BMO" branchs and is presumably converting them back to their branding.

https://www.google.com/search?client=firefox-b-d&q=first+cit...

I mean that could still be encrypted. But passwords should never be reversible. It should be hashed with scrypt or apparently now Argon2id.

I mean literally like if the person's password was "potato##!" the customer service person would read back "potato##!". They weren't reading the encrypted contents of a pw field.

That doesn’t mean that it is stored as plain text. It just means that it isn’t hashed.

I agree that it any system that allows this IS almost certainly just storing as plain text, and that it’s bad regardless.

their point is it could have been stored encrypted and then decrypted for the customer service person to read back to you. Access to plain text != storing it as plain text.

The only way three people can keep a secret is if two of them are dead.

If the data can be read by so many people in the company that even the customer service people have access, it's functionally not encrypted.

I don't disagree with you, however the original claim of

> provably storing peoples' online banking logins in plaintext in some ancient mainframe database system

Is not about functional encryption but storing directly as plain text.

Reply on news.ycombinator.com