Same with Natwest in the UK (ddmmyyynnnn) as the username/userid, 4 digit pin (asked for 3), "password" (asked for 3).

So my username is not all that hard to bruteforce, and the pin/password must be stored unhashed (or variations/combinations hashed).

Super secure.

Urgh.

They probably do store the unhashed pin/password rather than the quadratically-many 4 x N\choose 3 combinations.

Still, at least an account with known username is guarded with a secret from a space of size 10^3 x k^3, for k =~ 70 or so.

With AIB, that space has size 1000 and for a time, they were revealing a little account information when provided only with the user id: http://olivernash.org/2015/11/18/security-theatre-at-allied-...

It’s a 4 digit PIN, do you really think hashing would do anything other than amuse hackers?

You have a good point, though I _presume_ the challenge for the three digits of the PIN is made in tandem with the challenge for three characters from the password (making the cracking easy but not perhaps totally hilarious).

Were this not the case, I would have claimed that the number of combinations was 10^3 + k^3 rather than 10^3 x k^3.

If the challenge is indeed made in tandem then the PIN is essentially just a mandatory 4-digit prefix to the password. Still, the fact that only three characters of each part is requested is essentially fatal to the security any hashing scheme, as you say.

Even though this is not as ridiculous as hashing the four PIN challenges independently, which would be crackable with a lookup of amusingly-small size 1000, it still only needs a lookup of size about 700^3 =~ 350 million.

This might be roughly the threshold to annoy rather than to amuse?

I'm getting rather ridiculous myself at this stage but THEORETICALLY, if the hashes were all done including a long enough salt that was stored independently of the hashes then I believe there would be genuine significant security improvement to hashing.

Getting even more exotic, if the salt were also ENORMOUS, then it could make computing the required ~350 million hashes rather a costly endeavour (even in the event that the salt was obtained together with the hashed challenges).

Anyway.