The Effectiveness of Publicly Shaming Bad Security

Re:The Effectiveness of Publicly Shaming Bad Security by jedberg on Tuesday September 11, 2018 @01:14PM (#17961544)

That usually happens on banking sites because their system is backed by an old mainframe that can only handle 8 characters. The second thing you said is right though -- they probably have terrible security on that mainframe.

[ Parent | on HN ]

Re:The Effectiveness of Publicly Shaming Bad Security by chatmasta on Tuesday September 11, 2018 @01:54PM (#17961867)

NatWest goes a step further and asks you to enter (for example) “the 1st, 5th, 8th and 9th character of your password.”

I saw a comment once explaining why this might make sense to prevent replay attacks. But it seems awfully absurd.

[ Parent | on HN ]

Re:The Effectiveness of Publicly Shaming Bad Security by jedberg on Tuesday September 11, 2018 @02:41PM (#17962219)

Not to mention it means they are storing the password in plaintext.

[ Parent | on HN ]

Re:The Effectiveness of Publicly Shaming Bad Security by pps43 on Tuesday September 11, 2018 @01:36PM (#17961728)

They could still hash the long password, without trimming, and store 64 bits of that hash.

[ Parent | on HN ]

Re:The Effectiveness of Publicly Shaming Bad Security by jedberg on Tuesday September 11, 2018 @02:40PM (#17962214)

True, but then you'd have to make sure that all software that accesses that field is aware of the hash, and chances are if you have a legacy system like that, you have legacy software too.

[ Parent | on HN ]

Re:The Effectiveness of Publicly Shaming Bad Security by manigandham on Tuesday September 11, 2018 @01:19PM (#17961593)

Why does the accounts system have to use that mainframe?

[ Parent | on HN ]

Re:The Effectiveness of Publicly Shaming Bad Security by jedberg on Tuesday September 11, 2018 @02:39PM (#17962204)

In most cases it's because the mainframe holds all the customer data and is the system of record, and it's just easier to do it that way.

[ Parent | on HN ]