Has HL been hacked? New passwords required.

zagfles

TrustyOven wrote: »

But that's the simple, dismissive explanation.

Why would they need to if their security methds were good to start with?

All my banks have changed their security process for login over the years. Generally an extra layer to do stuff like set up new payees.

Any why reduce it to a number pin which has 10 permutations per digit rather than 26 for a letter?

You might have a point if people used random letters. But they don't. They tend to use words or names. That means for someone who knows a little about the you, or even someone who doesn't, if they saw the 3 letters entered from the drop down, or heard you on the phone, they might be able to work out or make an educated guess as to the rest of your password. That is less likely with numbers.

Friend of mine was on a train and sat opposite him was a bloke in a Sheffield Wednesday shirt. He make a phone call, probably to his bank. My friend heard him say "3rd letter - D, and fifth letter E". What do you think his password might have been?

TrustyOven

zagfles wrote: »

All my banks have changed their security process for login over the years. Generally an extra layer to do stuff like set up new payees.

True. If they added an extra layer that would make sense.
They seem to be replacing the passwords though. That suggests the old ones have been compromised.

zagfles wrote: »

Friend of mine was on a train and sat opposite him was a bloke in a Sheffield Wednesday shirt. He make a phone call, probably to his bank. My friend heard him say "3rd letter - D, and fifth letter E". What do you think his password might have been?

Numbers might be DoB, I think that was a common theme at one point?
Good point though in general.

Zanderman

Looks like a perfectly straightforward change of login system to me.

Why assume they've been hacked?

There's nothing whatsoever to suggest that!

Zanderman

TrustyOven wrote: »

They seem to be replacing the passwords though. That suggests the old ones have been compromised.

No it doesn't.

redpete

TrustyOven wrote: »

True. If they added an extra layer that would make sense.
They seem to be replacing the passwords though. That suggests the old ones have been compromised.

No it doesn't. There is a continual battle between the methods, tools and processes used to attack security and those defending against them. Changes to address a new potential vulnerability will keep happening and doesn't mean the vulnerability has been exploited.

Prism

TrustyOven wrote: »

They seem to be replacing the passwords though. That suggests the old ones have been compromised.

From an IT system perspective...

They are very likely introducing a new system for login security. Once passwords are entered into a system they are not stored in a form that they can be extracted again. It would not typically be possible to migrate the old passwords to the new system unless that feature was specifically built in. Therefore the easiest thing they can do is get you to use your old password to identify you, then present you with an interface to generate the new password in the new system, to migrate you over. Once that has happened the old account/password can be removed.

jamesd

Prism wrote: »

They are very likely introducing a new system for login security.

I think they are weakening the security for mobile phone convenience.

Prism wrote: »

Once passwords are entered into a system they are not stored in a form that they can be extracted again.

In a world where it was done correctly. I doubt that it was for the original system since a selection of three of the characters was required. The full trading password was needed so they are more likely to have got that right by storing part of a salted hash.

You can securely do select three systems by generating the permutations when the new code is supplied and storing partial salted hashes of the permutations. Don't have to store much to have high enough confidence that the sequence was known.

TrustyOven

Prism wrote: »

From an IT system perspective...

They are very likely introducing a new system for login security. Once passwords are entered into a system they are not stored in a form that they can be extracted again. It would not typically be possible to migrate the old passwords to the new system unless that feature was specifically built in. Therefore the easiest thing they can do is get you to use your old password to identify you, then present you with an interface to generate the new password in the new system, to migrate you over. Once that has happened the old account/password can be removed.

I think your explanation is probably the best one so far. Maybe they are salting the passwords this time and they didnt before.


I wonder how does one implement a salted one-way encryption if the user is given drop down boxes 3 characters - you cant take the whole input, salt it and then pass through char crypt(...) if that's what they use and then expect to be able to pluck out individual chars out of the encrypted stored password unless you use a symmetric algorithm?

zagfles

TrustyOven wrote: »

I think your explanation is probably the best one so far. Maybe they are salting the passwords this time and they didnt before.


I wonder how does one implement a salted one-way encryption if the user is given drop down boxes 3 characters - you cant take the whole input, salt it and then pass through char crypt(...) if that's what they use and then expect to be able to pluck out individual chars out of the encrypted stored password unless you use a symmetric algorithm?

Surely they just encrypt and store all combinations (salted differently). Eg if the password is 6 chars long and it asks for 3, there are 20 possible combinations so store 20 differently salted & encrypted values.

AnotherJoe

TrustyOven wrote: »

True. If they added an extra layer that would make sense.
They seem to be replacing the passwords though. That suggests the old ones have been compromised.

Only to someone wearing a tin foil hat.