3

I have a question about how my bank implements passwords. I feel like the way the input works they can't be hashing in a safe way. Would it be on topic to show the input screen and ask if there is a way this could be implemented securely?

  • 1
    I don't think so, as many banks do use secure password mechanisms and inputs, the answer is going to be yes. Whether or not your bank does is another matter, and is probably off topic. – Rory Alsop Sep 23 '15 at 22:37
  • @RoryAlsop and many don't.... ;-) – AviD Sep 24 '15 at 7:51
  • @inquisitiveIdiot I think another part of the problem is that we would need to guess as to the implementation, which is very hard to do, especially considering how, umm.. creative, bank developers can be. – AviD Sep 24 '15 at 7:52
  • But, I'm guessing they are asking for specific characters of your password? E.g. 3rd, 5th, and 6th letters of your password. I've seen that around a lot, I view it as snakeoil, however ignoring the faulty concept the implementation might not be completely horrible. – AviD Sep 24 '15 at 7:53
3

Questions on "How to do it?" are on-topic here (and I said "How to do it?", not "Do you mind make it for me?" which is a different thing ;) ).

At the opposite, questions on "How it's done?" are most often flawed (except in a few cases like open source projects for instance where everyone is free to check how it has been done), since anyone can just guess and express suppositions with no clear facts or answers.

And usually, the lack of facts and clear answer is no good on such a Q&A website.

P.S.: Another related question which I think to be on topic would be "What security does it bring?", since it is less dependent on the internal implementation and allows to develop clear answers on the threat models (or the lack of...) addressed by the described solution.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .