Re:AdultFriendFinder was hacked
by adanto6840 on Sunday November 13, 2016 @12:45PM
(#12944521)
That bank sounds to have bigger issues: perhaps obvious, it's very likely that they were storing the password as plaintext -- since they were able to ask you for a specific character and verify that your answer was correct. Scary.
Have also never heard of a bank that actually asked for a password, substring or not, at least aside from being asked for a 'Phone PIN' or similar lesser/non-critical to authentication piece of information.
In my experience banks store pins in plaintext way to often.
The uppercase being indifferent is a first for me but I've had those people tell me that performing copy paste into the password input somehow changed the authentication procedure. He again acted as if I was a complete idiot for suggesting that that made no sense.
The point was more about the reaction of the rep, that it was ludicrous of me to consider passwords to be case sensitive, but yeah, not a good sign in general, though as I use a unique password for everything (1Password) I'm less concerned.
Related, the "3d secure" credit card verification system asks for individual chars of a password (at least in the UK).
If your bank is compromised to the point that your password - plaintext or otherwise - has been discovered, can things get much worse?
Re:AdultFriendFinder was hacked
by brazzledazzle on Sunday November 13, 2016 @01:05PM
(#12944614)
It's possible that they create the character entry when you set your password and the bank/operator only has access to that particular character in plain text.
I am in two minds wether a service used by non technical people should allow for case insensitive passwords, it'd be interesting to see what the difference in support load, customer satisfaction and churn would be for both case sensitive and case insensitive passwords, and also enforcing minimum complexity.