21

I'm not particularly well versed in IT security so please bear with me.

I recently discovered that my bank's online system will accept passwords that consist of the correct password, and a string of random characters. So for example, if my password is "password", it will accept things like "password1" or "password43435". I'm fairly sure this shouldn't happen with any sort of hashing + salt method, or even a string comparison. It's making me worried that it's just horribly insecure, so I'm wondering if there's any secure method for storing passwords that allows things like this to happen. And if not, can anyone explain how things like this happen?

  • 4
    Have you tried this for passwords shorter than 7 characters? It may well be something like the old DES crypt hash that truncates longer passwords. – Polynomial Jan 22 '14 at 17:24
  • 5
    I would love to know the bank name, if that is possible =) – kiBytes Jan 22 '14 at 17:32
13

Sure there is, but this doesn't mean it is a good practice.

Probably your bank is chopping your password to eight chars (this limit was highly used in old systems). Your bank simply takes the first eight chars of the string, hash it and compare against their own hash. This is secure, at least, as secure as the length limit of its password.

There are more possibilities like they try every hash in the string with the first 4,5,6,7...N (where N is the length of the string the user entered) chars until they find a match, but I believe that my first guess is the good one =)

So you will have a log-in as secure as your first eight chars (or the amount they are using). If they simply use the second method (which I extremely doubt) the log-in will be as secure as your password length.

I won't enjoy my bank doing so but... Consider that they hold the responsibility if they got hack since your money is guaranteed by them (but you will have headaches).

  • 4
    Not only that, but you hope you have enough complexity in those first few characters. "password1q@W" is nice and complex. "password" will be tried first in brute force ... If they only use 8 chars, then they need to communicate that to users to enable them to compensate. – schroeder Jan 22 '14 at 18:17
  • 1
    "Consider that they hold the responsibility if they got hack since your money is guaranteed by them (but you will have headaches)." Not all countries have the same loss laws the United States does. – Rubber Duck Apr 11 '14 at 15:18
9

It isn't very secure but with banks this is a not uncommon pattern. What's likely happening is that they have a back-end system (think mainframe or other legacy platform) which has a hard upper limit on password length.

So I'd guess that what they're doing is truncating the password, probably before passing it to the mainframe for storage. On that basis they could be hashing the password properly as long as they always truncate it before hashing. Alternatively they may be encrypting it and using some form of security hardware (e.g. a Hardware security module (HSM)) to protect the encryption keys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.