Hacker News Reader

Comment by manojlds | Hacker News Reader

My bank limits my password to 8. When I questioned while creating my account, they asked me to visit the login page - in the login page you are asked for the answer of the security question and also presented with 8 input boxes - one for each of of the password characters - but having to enter only randomly selected few from the password ( for preventing key loggers from getting password, of course ). This seemed like a valid technical reason to limit passwords to 8.

View on HN

Wait. Doesn't that imply your bank is storing your password in plaintext, or at best salted and hashed each individual character of your password? (Which is still horrible, because it now takes O(n) instead of O(n^8) to crack stolen hashes)

Oh they probably are storing it in plaintext

I believe they have some legitimate reasons for doing that (like the example quotes)

Another reason for specifying a length/limits is that you may need to type it using another device (like an ATM) and keeping it apart from other passwords (if you allow everything, you'll just use your gmail password or something)

Now, to be honest, if you break into a bank db, why are you going to bother with passwords?

The client, or server, could just concatenate all the chars and then calculate whatever hash you desire of the result. Or?

Yes, if the machine is compromised the attacker could do it as well but the point was to prevent keyloggers specifically.

If I understand correctly, you are only asked to fill in a few of the 8 characters. (I have seen this before.)

You are presented with

* * [ ] * [ ] * * [ ]

and you are supposed to submit

* * [3] * [5] * * [8]

so neither side would have enough information to reconstruct the full password based on the user's input alone.

Or they could generate say, 10 masks, hash them along with the password and then only present you with one random mask from those 10.

What kind of security is that? Don't you think an attacker who can install a key logger could also install a screen grabber? This definitely smells like a false sense of security.

It might be insecure, but not in the way you mention. You only enter 3 or so characters while logging in. Others are hidden. Screen grabber can get only the three characters. Of course, if you login multiple times, the password can be obtained eventually. But this probably for one time login at a public computer.

And yeah, like in many things, these are done to give a false sense of security to the user and some minimal deterrent to the attacker.

8 choose 3 = 56

Even sniffing just one login gives a completely practical attack to gain access to your account, even though the attacker doesn't have the full password. They might not be able to do everything the full password would let them do, but its still not exactly acceptable.

May I ask what bank you bank with?

Natwest do exactly this.

They also require two factor authentication for all actual money transactions via a chip-and-pin card reader they ship to all customers. You only authorise one transaction for a specific amount/destination at a time.

All UK financial institutions I have used do this: Nationwide, Barclay's, Natwest (RBS).

Which is one of the reasons I do not use online banking!

I don't know your bank, but in my case (Barclays) as mentioned above, I'd think their tellers or credit card authorization would both be a weaker spot for attacks than their online banking.

They don't allow you only log in with two characters from your password like that, you also need a passcode or a one time pad generated with a chip and pin reader, and for transfers to accounts you haven't previously transferred money to and indicated you want to save for future use, you also need to enter your pin, amount and target account into the reader to get a code to enter into online banking to do the transfer.

Well yes, but not as the only security mechanism, as far as I'm aware.

Barclays for example allows you to log in with this plus a separate pass code, but you can't do much damage without using a chip and pin reader that will give you an 8 digit one time pad too (alternatively they now let you use a mobile app to generate the one time pads)

E.g. you can't do transfers to recipients you haven't specifically saved for future payments, for example, without entering your pin, the account number and amount into your key generator and entering the resulting code into online banking.

This was HSBC in Canada.

I am not a security expert, and realize that this may not be the right thing, and the implementation might be horrible, but if there is a reason to limit password to 8, this was a good enough reason to do so :)

A certain other Canadian bank only allows passwords with a length of 6, no more, no less. This bugs me to no end with how insecure it is. I believe their excuse is because the same password is used for your phone banking password and that one must be 6 characters.

Reply on news.ycombinator.com