2

The german brank credit report service "Schufa" uses a so called "SuperPIN" to enable users to reset their password. This super pin is a permutation of 30 lower and upper case letters and digits and is snail mailed to the user at registration.

To reset the password the system selects two positions and requests the characters at those positions.

I wonder how safe this system is against attacks to the server. The superpin cannot be stored salted and hashed because the server needs access to every individual character. Hashing and salting the character at every position (or all the 870 pairwise combinations) would not resist a brute force attack against the hash either.

From this facts I cannot derive an advantage over snail mailing a reset code to the user. What did I miss?

Improve this question
3
  • On top of my comment on Thorium answer, snail mail is usually looked as a more secure transport rather than email. In most countries an auditor will be happy to send something over snail mail (eg. a password) but would never agree to send a password over email.
    – HocusPocus
    Oct 10, 2014 at 13:44
  • It may be important to note that if you are under a targeted attack snail mail can be easily intercepted.
    – Matthew Peters
    Oct 10, 2014 at 14:31
  • It may be important to note that if you are under a targeted attack, you can be easily intercepted on the streets.
    – ThoriumBR
    Oct 10, 2014 at 14:40

1 Answer 1

Reset to default
1

We are talking about the database of a bank, and that's not your average database. It's a special kind of database, when every step is audited, every alteration is logged. So a database leak is very, very unlikely.

If someone can get access to the bank database, why bother with PIN or password for any user? They can go direct to the money.

The reason to send snail mail for the user is that the bank can almost surely know that only the real owner of the account have the reset codes. If anyone else tries to reset the PIN by using discovered information, it will fail because the fraudster don't have the reset codes.

And unless the fraudster can convince the owner of the account to disclose the codes, only the owner can reset the PIN.

Improve this answer
4
  • 1
    And probably that string is obtained from a cryptographic operation on some data, rather than being stored in a DB. that means that for an attacker to get that from the bank needs to steal: user data, key used to generate the string (which is probably in an HSM) and maybe whatever algorithm that joins the user data to generate the string (for example account number | branch code | day the account was opened)
    – HocusPocus
    Oct 10, 2014 at 13:42
  • My question was not targeting the security of the db. I wonder whether this super-pin-let-me-ask-two-digits theater is more secure than snail mailing a "master password" to the users. This master password can be salted and hashed and so on and -- too me -- seems to be more secure than storing the super pin digits.
    – ordnungswidrig
    Oct 10, 2014 at 19:45
  • @HocusPocus under the unlikely assumption someone get's access to db, it also would get access to the information that serves as the source for the super pin. How could the system check if a user provided the correct characters?
    – ordnungswidrig
    Oct 10, 2014 at 19:46
  • @ThoriumBR The question refers to a bank credit report service, not a bank. That’s a regular company. There’s no way they can afford such security measures.
    – Synoli
    Oct 12, 2018 at 10:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .