2

I have recently changed banks and my new bank has a benefit scheme (discounts etc.) that has its own website and different login details to my online banking (I think the benefits system is administered by a third-party).

They are clearly storing passwords in plain text and there's no ability to change my password to anything of my own choosing. This is the main crux of a complaint I will be making to the ICO on GDPR grounds.

However, the username is also preset and unchangeable. To make matters worse, IMO, is that the username is my bank sort code + account number. I am trying to decide if this is also a security issue.

  1. Whilst my bank account number is not necessarily secret (it is printed on cheques, and I need to give it to people to transfer money to me), it seems needlesly open.

  2. While most other websites also don't allow you to change your username and pre-set your username to your email address, in that scenario I at least have the option to create a throwaway email address, or use a + address.

  3. It limits usernames to a single character set (numeric) which makes it easier for brute force hackers etc.

  4. Someone hacking my account will be able to gain the following information about me:

    • Name
    • Address
    • Sort code
    • Account number
    • Email address
    • Phone number

All that's missing to make the complete set of personal information would be my date of birth, and for all I know they're storing that information about me behind the scenes too.

Should I use the username argument to strengthen my complaint about the password storage?

  • How do you know they are storing password in plaintext? – Vipul Nair Jul 16 at 14:30
  • @VipulNair because the password was emailed to me. – Darren Jul 16 at 14:31
  • @Darren they could’ve emailed you your password before hashing and storing it. Still, that’s a bad practice. – Andrew Morozko Jul 16 at 14:34
  • @AndrewMorozko well I accept that's possible, but seems unlikely. Regardless, the scope for it being intercepted and my inability to change it is concerning. – Darren Jul 16 at 14:35
  • @Darren true. As for username, they are generally assumed to be non-secret and aren’t considered a part of security architecture. I have no idea about the law, but who knows how courts may think about it. – Andrew Morozko Jul 16 at 14:38
5

To address your primary question: a username is largely security neutral. NIST doesn't really have specific guidelines dictating what usernames a system should require. On page 21 of NIST Special Publication 800-63-3 (Section 4):

..the RP (relying party) may request the CSP (Credential Service Provider) assert information about the subscriber, such as verified attribute values, verified attribute references, or pseudonymous identifiers (i.e. your account number). This information assists the RP in making authorization decisions. An RP [..] may only need specific attributes, resulting in the subject retaining some degree of pseudonymity. This privacy enhancing approach is a benefit of separating the strength of the proofing process from that of the authentication process.

From a security perspective: how a username is determined is often the least critical part of the entire authentication design process. Is it ideal for you to have a username that both identifies your bank down to the branch (your sort code) in combination with your account number? No. Is it the ideal way for a relatively large system to assign potentially tens or hundreds of thousands of usernames to unique individuals across multiple geographic locations? Probably, yes.

To address your specific situation: yes - as you have already outlined, it is less secure to have your username be your account number than it would be to set it yourself - but it's also more secure than having firstinitial.lastname or some other similarly structured syntax.

Based on whom you are considering making your complaint to, I am going to assume you are in the UK - so you may be able to find more specific guidance for UK and the EU (while you guys are still in it). By all means - make a complaint if you think it might help the situation, just keep in mind that there is no legal way for you to know for sure whether or not they are storing user passwords in plain text on their systems. In my opinion: being unable to change your password is the biggest red flag in the whole situation - so that might be where you can find some traction.

To address your points:

  1. Whilst my bank account number is not necessarily secret (it is printed on cheques, and I need to give it to people to transfer money to me), it seems needlesly open.

Your bank account number is as open as you allow it to be. Only write checks/give your routing information to trusted parties, secure your mailbox as best as you can, and if all else fails - choose another bank or change your banking practices. If your trust issues conflict with whatever convenience/benefits you are gaining, that is your decision to weigh.

  1. While most other websites also don't allow you to change your username and pre-set your username to your email address, in that scenario I at least have the option to create a throwaway email address, or use a + address.

This depends completely on the organization/company/system you are dealing with - in most cases dealing with money/bills where your account is automatically generated, you won't get to pick.

  1. It limits usernames to a single character set (numeric) which makes it easier for brute force hackers etc.

No one is going to brute force your username. Someone getting into your e-mail (and retrieving your password), gaining access to your [hopefully hashed] password from the benefits system, or logging your password because the computer you use to access the site has been compromised are the real issues here.

  1. Someone hacking my account will be able to gain the following information about me:
    • Name
    • Address
    • Sort code
    • Account number
    • Email address
    • Phone number

If someone is hacking your account specifically (as opposed to passive collection or downloading as many user credentials as they can), you can probably assume that all of those pieces of information are what they are already working with. Most of that (and including your date of birth) will be publicly available anyway, most of it is written directly on your checks, etc.

In conclusion: if you are making a complaint, include everything you can prove - maybe even what you expect is happening on the backend - but don't get your hopes up.

  • 1
    "there is no legal way for you to know for sure whether or not they are storing user passwords in plain text on their systems" Not true. If they are able to give you your password upon request (as opposed to only "at time of setting it"), then they are storing in plain text. Or they're encrypting it, but in security terms that's effectively the same thing. A minor error in an otherwise very good answer. – Jim Cullen Jul 16 at 23:00
  • Regarding your NIST citation, I believe a different security model is being used. The bank is not the service provider, and the benefits company is not a relying party. It sounds like the bank transmitted the info to the third party and OP now has multiple accounts to maintain. (If I am parsing things correctly). – jww Jul 16 at 23:16
  • @jww you are correct. – Darren Jul 17 at 2:01
  • @JimCullen that's true - I was more just going off the wording in the question where there was no indication Darren is able to request his password and get a response. regarding the NIST citation - I couldn't really find any other guidance that did a good job outlining username specific security (other than the google page I linked and maybe some FTC op-eds) - so I really only included it as an "even this really official thing doesn't cover usernames beyond a broad definition" type thing. why wouldn't the bank or benefits company be considered a service provider in this scenario? – mael' Jul 17 at 4:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.