• Server storage of "memorable data"

    From Ben Bacarisse@ben@bsb.me.uk to sci.crypt on Wed Aug 5 17:21:40 2026
    From Newsgroup: sci.crypt

    I don't use Usenet much these days (so forgive me if I am not prompt to
    reply) but I've just come across a sci.crypt adjacent question.

    My bank offered to allow me to log in today using my "memorable data"
    (MD) rather than my password. This MD is just a string you can choose
    and it is essentially arbitrary. They hope you will make it longer than
    a password but easy to remember.

    So far so good. I thought (when I signed up years ago) that this MD
    would be used as an extra, in person, check over the phone. But the
    login page prompts for four selected characters from it, for example the
    2nd, 5th, 6th and 12th. How does the server check these without storing
    the MD in plain text?

    We all know that servers don't (at least shouldn't) store passwords.
    They store hashed data and hash what you type to do the comparison. But
    with only selected characters being asked for what do they do? Is there
    some clever maths that has passed me by, or is there something not very
    secure going on here?
    --
    Ben.
    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Richard Harnden@richard.nospam@gmail.invalid to sci.crypt on Wed Aug 5 17:48:01 2026
    From Newsgroup: sci.crypt

    On 05/08/2026 17:21, Ben Bacarisse wrote:
    I don't use Usenet much these days (so forgive me if I am not prompt to reply) but I've just come across a sci.crypt adjacent question.

    My bank offered to allow me to log in today using my "memorable data"
    (MD) rather than my password. This MD is just a string you can choose
    and it is essentially arbitrary. They hope you will make it longer than
    a password but easy to remember.

    So far so good. I thought (when I signed up years ago) that this MD
    would be used as an extra, in person, check over the phone. But the
    login page prompts for four selected characters from it, for example the
    2nd, 5th, 6th and 12th. How does the server check these without storing
    the MD in plain text?

    We all know that servers don't (at least shouldn't) store passwords.
    They store hashed data and hash what you type to do the comparison. But
    with only selected characters being asked for what do they do? Is there
    some clever maths that has passed me by, or is there something not very secure going on here?


    I suppose they could hash, 'A----', '-B---', '--C--' etc. I bet they
    don't hash it at all.

    My bank is now allowing (or rather: forcing) me to login with just my
    username and memorable data. They used to want username+password+MD.
    They say not needing the password makes it easier and no less secure.

    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Doc O'Leary ,@droleary.usenet@2023.impossiblystupid.com to sci.crypt on Wed Aug 5 18:25:05 2026
    From Newsgroup: sci.crypt

    For your reference, records indicate that
    Richard Harnden <richard.nospam@gmail.invalid> wrote:

    On 05/08/2026 17:21, Ben Bacarisse wrote:

    So far so good. I thought (when I signed up years ago) that this MD
    would be used as an extra, in person, check over the phone. But the
    login page prompts for four selected characters from it, for example the 2nd, 5th, 6th and 12th. How does the server check these without storing the MD in plain text?

    I suppose they could hash, 'A----', '-B---', '--C--' etc. I bet they
    don't hash it at all.

    Given that itrCOs a bank, I would *hope* theyrCOre doing better than that. They might be doing some sort of shared secret scheme. The rabbit hole to
    go down is:

    <https://en.wikipedia.org/wiki/Partial_password>

    Regardless, it sounds like a really dumb way to implement a password replacement. I mean, why bother supporting a human-friendly pass phrase
    like `correct horse battery staple` if yourCOre just going to immediately
    turn around and make them start doing arbitrary index calculations on it? Times four!

    My bank is now allowing (or rather: forcing) me to login with just my username and memorable data. They used to want username+password+MD.
    They say not needing the password makes it easier and no less secure.

    It certainly can/should be. Given a long enough phrase, you donrCOt even
    need a username, but it does serve as a handy unique rCLsaltrCY for the hash. To my thinking, supporting a username is kind of dangerous, because that
    then encourages sharing the same secret on multiple sites, which is one
    of the things that makes hard passwords problematic. The hash (and/or a derived token) is the *actual* key underneath, so why pretend otherwise?

    IrCOm doing this right now for a project IrCOm working on. The idea being that I want to invert the value of short/common account names (i.e., if
    you use just `rick` to set it up, itrCOs not going to be very secure, but yourCOd probably be OK with `rick is a super cool guy with a dog named dumdum`).
    --
    "Also . . . I can kill you with my brain."
    River Tam, Trash, Firefly


    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Johann 'Myrkraverk' Oskarsson@johann@myrkraverk.invalid to sci.crypt on Thu Aug 6 04:16:12 2026
    From Newsgroup: sci.crypt

    On 06/08/2026 2:25 AM, Doc O'Leary wrote:
    For your reference, records indicate that
    Richard Harnden <richard.nospam@gmail.invalid> wrote:

    On 05/08/2026 17:21, Ben Bacarisse wrote:

    So far so good. I thought (when I signed up years ago) that this MD
    would be used as an extra, in person, check over the phone. But the
    login page prompts for four selected characters from it, for example the >>> 2nd, 5th, 6th and 12th. How does the server check these without storing >>> the MD in plain text?

    I suppose they could hash, 'A----', '-B---', '--C--' etc. I bet they
    don't hash it at all.

    Given that itrCOs a bank, I would *hope* theyrCOre doing better than that. They might be doing some sort of shared secret scheme. The rabbit hole to
    go down is:

    <https://en.wikipedia.org/wiki/Partial_password>

    Regardless, it sounds like a really dumb way to implement a password replacement. I mean, why bother supporting a human-friendly pass phrase
    like `correct horse battery staple` if yourCOre just going to immediately turn around and make them start doing arbitrary index calculations on it? Times four!

    My bank is now allowing (or rather: forcing) me to login with just my
    username and memorable data. They used to want username+password+MD.
    They say not needing the password makes it easier and no less secure.

    It certainly can/should be. Given a long enough phrase, you donrCOt even need a username, but it does serve as a handy unique rCLsaltrCY for the hash. To my thinking, supporting a username is kind of dangerous, because that
    then encourages sharing the same secret on multiple sites, which is one
    of the things that makes hard passwords problematic. The hash (and/or a derived token) is the *actual* key underneath, so why pretend otherwise?

    IrCOm doing this right now for a project IrCOm working on. The idea being that I want to invert the value of short/common account names (i.e., if
    you use just `rick` to set it up, itrCOs not going to be very secure, but yourCOd probably be OK with `rick is a super cool guy with a dog named dumdum`).


    Given that it's a bank, do they know how to generate these phrases
    securely? This is not an idle question, as people have been draining "cryptowallets" for this very reason.

    https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html

    A large part of the problem with bank security, is that the people we
    talk to -- generally the tellers -- have no authority to question the
    security, if we the customers point out that something isn't as safe as
    the bank claims it is.

    Security in the financial transaction world seems to be getting better,
    but given my brief introduction at the customer end of it, I'm not hold-
    ing my breath for anything I'd call /secure/ to show up in the banking
    world.


    Have a nice and safe banking day!
    --
    Johann | email: invalid -> com | http://www.myrkraverk.com/blog/
    I'm not from the Internet, I just work there. | via Easynews.com https://bsky.app/profile/myrkraverk.bsky.social | for ( ;; ) _:;
    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Doc O'Leary ,@droleary.usenet@2023.impossiblystupid.com to sci.crypt on Fri Aug 7 00:06:58 2026
    From Newsgroup: sci.crypt

    For your reference, records indicate that
    Johann 'Myrkraverk' Oskarsson <johann@myrkraverk.invalid> wrote:

    Given that it's a bank, do they know how to generate these phrases
    securely? This is not an idle question, as people have been draining "cryptowallets" for this very reason.

    Tech bros are (very intentionally) not banks. Actual banks are going to
    be on the hook for losses, not running rug pull frauds from the inside.
    Which is not to say any individual bank employees is above trying it, or
    that rCLtoo big to failrCY bailout nonsense doesnrCOt happen, of course.

    A large part of the problem with bank security, is that the people we
    talk to -- generally the tellers -- have no authority to question the security, if we the customers point out that something isn't as safe as
    the bank claims it is.

    IrCOve worked for banks before, and thatrCOs simply not true. As a regulated industry, there are *many* mechanisms in place for customers and employees
    to report problems they see, including doing so anonymously. Please name
    an actual bank and describe their behavior that has you making such a
    claim. Mere speculation on hashing algorithms isnrCOt enough.
    --
    "Also . . . I can kill you with my brain."
    River Tam, Trash, Firefly


    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Johann 'Myrkraverk' Oskarsson@johann@myrkraverk.invalid to sci.crypt on Fri Aug 7 18:11:25 2026
    From Newsgroup: sci.crypt

    On 07/08/2026 8:06 AM, Doc O'Leary wrote:
    For your reference, records indicate that
    Johann 'Myrkraverk' Oskarsson <johann@myrkraverk.invalid> wrote:

    Given that it's a bank, do they know how to generate these phrases
    securely? This is not an idle question, as people have been draining
    "cryptowallets" for this very reason.

    Tech bros are (very intentionally) not banks. Actual banks are going to
    be on the hook for losses, not running rug pull frauds from the inside.
    Which is not to say any individual bank employees is above trying it, or
    that rCLtoo big to failrCY bailout nonsense doesnrCOt happen, of course.

    A large part of the problem with bank security, is that the people we
    talk to -- generally the tellers -- have no authority to question the
    security, if we the customers point out that something isn't as safe as
    the bank claims it is.

    IrCOve worked for banks before, and thatrCOs simply not true. As a regulated industry, there are *many* mechanisms in place for customers and employees
    to report problems they see, including doing so anonymously. Please name
    an actual bank and describe their behavior that has you making such a
    claim. Mere speculation on hashing algorithms isnrCOt enough.


    Oh, I was thinking of my attempt to show my local branch manager that
    using SMS for two factor authentication wasn't as secure as the official
    spiel from the bank made it sound like.

    What 2FA does your bank use? Do you believe I stood a chance, as a mere customer, to get the bank to use something else for the two factor?

    I would /hope/ that a bank used a good implementation of Fortuna for
    actual cryptograhical random numbers, but I'm not in a position to audit
    it. It's not like it's in the bank's best interest to show us exactly
    how they seed their cryptographic random numbers, because it could turn
    out to be an attack vector.


    Best wishes, and happy cryptography!
    --
    Johann | email: invalid -> com | http://www.myrkraverk.com/blog/
    I'm not from the Internet, I just work there. | via Easynews.com https://bsky.app/profile/myrkraverk.bsky.social | for ( ;; ) _:;
    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Johann 'Myrkraverk' Oskarsson@johann@myrkraverk.invalid to sci.crypt on Fri Aug 7 18:30:46 2026
    From Newsgroup: sci.crypt

    On 06/08/2026 2:25 AM, Doc O'Leary wrote:

    IrCOm doing this right now for a project IrCOm working on. The idea being that I want to invert the value of short/common account names (i.e., if
    you use just `rick` to set it up, itrCOs not going to be very secure, but yourCOd probably be OK with `rick is a super cool guy with a dog named dumdum`).


    I'm sure you know all of the following, so please just consider this
    less as a reply to you directly, and more of an educational opportunity
    for sci.crypt; one that I neglected to notice when last I replied.

    How are you generating your code words? If you have a pool of words
    such as, in a Lua table syntax, but that doesn't matter, { "foo", "bar",
    "baz", "quux" }, you can just ask your Fortuna for two bits of a random
    number at a time and get a reasonably good approximation to an even dis- tribution of bits.

    But if you add one more word to the mixture, and end up with { "doc",
    "foo", "bar", "baz", "quux" }, and try to ask the Fortuna for three
    bits, and just "modulate" -- the % in Lua -- for the index into the
    table, won't you get a random bias and one or more words will be more
    common than the others? Please forgive me if my logic is a bit off,
    it's been a while since I thought this through, and I'm running this
    basically on memory since I'm not in a position to re-evaluate all the
    logic involved.


    Happy non-random biased code word selection!
    --
    Johann | email: invalid -> com | http://www.myrkraverk.com/blog/
    I'm not from the Internet, I just work there. | via Easynews.com https://bsky.app/profile/myrkraverk.bsky.social | for ( ;; ) _:;
    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Rich@rich@example.invalid to sci.crypt on Fri Aug 7 22:07:51 2026
    From Newsgroup: sci.crypt

    Ben Bacarisse <ben@bsb.me.uk> wrote:
    I don't use Usenet much these days (so forgive me if I am not prompt to reply) but I've just come across a sci.crypt adjacent question.

    My bank offered to allow me to log in today using my "memorable data"
    (MD) rather than my password. This MD is just a string you can choose
    and it is essentially arbitrary. They hope you will make it longer than
    a password but easy to remember.

    So far so good. I thought (when I signed up years ago) that this MD
    would be used as an extra, in person, check over the phone. But the
    login page prompts for four selected characters from it, for example the
    2nd, 5th, 6th and 12th. How does the server check these without storing
    the MD in plain text?

    They /could/ be doing what Richard suggests, but I agree with Richard's
    final conclusion, they likely are not hashing anything and likely
    storing the "memorable data" as plain text.

    On the other hand, there /is/ one way they could be 'hashing' it, and
    if so that means this becomes very very insecure.

    You given them "correct horse battery staple" [1] as your memorable data.

    They "randomly" [2] select indexes 3, 6, 12 and 17 (ones based, as most
    normal humans don't label the "first" character as character zero).

    That gives r c s t (if my index counts have been correct) from this
    memorable data.

    They combine these four into "rcst" and hash and store that hash.

    And... every time you log in, they always ask for indexes 3, 6, 12 and
    17 from your "memorable data".

    Which means, /if/ this is what they have done, then they now have
    everyone using a "four character" password due to their own
    incompetence. Not good.

    But I could see some "bank type" thinking this was an "unbreakable
    password" system much like our old crank with his Ada code systems used
    to think every one of his schemes was uncrackable.

    So, let us know if they ask for different index positions with each new
    login, or if they always ask for the same set of indexes?


    [1] https://xkcd.com/936/?correct=horse&battery=staple
    [2] https://fridayfun.net/dilbert-2001-10-25
    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Doc O'Leary ,@droleary.usenet@2023.impossiblystupid.com to sci.crypt on Fri Aug 7 23:00:33 2026
    From Newsgroup: sci.crypt

    For your reference, records indicate that
    Johann 'Myrkraverk' Oskarsson <johann@myrkraverk.invalid> wrote:

    Oh, I was thinking of my attempt to show my local branch manager that
    using SMS for two factor authentication wasn't as secure as the official spiel from the bank made it sound like.

    Well, IrCOd generally say there can be a vast gulf between rCLas secure asrCY and rCLinsecurerCY. In a retail setting, absolutely *nothing* is top-shelf security, because no regular customers would use it.

    What 2FA does your bank use? Do you believe I stood a chance, as a mere customer, to get the bank to use something else for the two factor?

    I really have no idea what you expect any suggested change to accomplish. Banks are likely doing more risk assessment on the alternative schemes than
    we have or the branch manager is able to do. IrCOve never had *any* form of MFA be anything more than a hassle, because IrCOve never had anyone get to/past the password challenge.
    --
    "Also . . . I can kill you with my brain."
    River Tam, Trash, Firefly


    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Rich@rich@example.invalid to sci.crypt on Fri Aug 7 23:16:23 2026
    From Newsgroup: sci.crypt

    Doc O'Leary , <droleary.usenet@2023.impossiblystupid.com> wrote:
    I really have no idea what you expect any suggested change to
    accomplish.

    They likely have zero power to *do* anything.

    Banks are likely doing more risk assessment on the alternative
    schemes than we have or the branch manager is able to do.

    The bank "security" group would be the one making up the rules, and
    they likely worry only about being able to check the "checkboxes" on
    the compliance reports their regultors request. Ultimately what the
    bank allows as "security" is based on what checkboxes those regulators
    put on those forms.

    IrCOve never had *any* form of MFA be anything more than a hassle,
    because IrCOve never had anyone get to/past the password challenge.

    The thing is, the whole MFA push isn't intended for us few left here
    reading sci.crypt. We don't reuse passwords, and we generate proper
    random gibberish strings unique to each service for those passwords.
    We are more than secure enough (other than having our password manager
    stolen and broken into) using just a password login.

    MFA is aimed at the other 99.95% of the bank's customers, the ones who
    use:

    PassWord1!

    As their password everywhere, for every single service.

    MFA prevents (mostly) those folks from having their accounts emptied
    because the fact that someone can deduce (or find in a hack dump) their passwords still does not (usually, at least not without some social engineering as well) result in someone logging into their bank's web
    portal.

    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Doc O'Leary ,@droleary.usenet@2023.impossiblystupid.com to sci.crypt on Fri Aug 7 23:29:56 2026
    From Newsgroup: sci.crypt

    For your reference, records indicate that
    Johann 'Myrkraverk' Oskarsson <johann@myrkraverk.invalid> wrote:

    On 06/08/2026 2:25 AM, Doc O'Leary wrote:

    IrCOm doing this right now for a project IrCOm working on. The idea being that I want to invert the value of short/common account names (i.e., if
    you use just `rick` to set it up, itrCOs not going to be very secure, but yourCOd probably be OK with `rick is a super cool guy with a dog named dumdum`).


    How are you generating your code words?

    I donrCOt understand the question. I donrCOt have any rCLcode wordsrCY. The user
    picks whatever they consider to be unique rCLmemorable datarCY, and I just hash it (SHA-256 is good enough for now). If they choose poorly, by *whatever* method, they have an insecure account.

    Happy non-random biased code word selection!

    But even with completely random selection of words in a lookup table, something like a partial password scheme is going to reduce the security
    based on the common letter frequency of the words in the list (or the
    spaces between words, if thatrCOs not prohibited).
    --
    "Also . . . I can kill you with my brain."
    River Tam, Trash, Firefly


    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Johann 'Myrkraverk' Oskarsson@johann@myrkraverk.invalid to sci.crypt on Sat Aug 8 08:23:10 2026
    From Newsgroup: sci.crypt

    On 08/08/2026 7:00 AM, Doc O'Leary wrote:
    For your reference, records indicate that
    Johann 'Myrkraverk' Oskarsson <johann@myrkraverk.invalid> wrote:

    Oh, I was thinking of my attempt to show my local branch manager that
    using SMS for two factor authentication wasn't as secure as the official
    spiel from the bank made it sound like.

    Well, IrCOd generally say there can be a vast gulf between rCLas secure asrCY and rCLinsecurerCY. In a retail setting, absolutely *nothing* is top-shelf security, because no regular customers would use it.


    But you can buy extra secure/strong shelf, if you have the budget for
    it. The kind of shelves they use in backrooms and warehouses. And
    store your collection of SGI workstations. They are heavy.


    What 2FA does your bank use? Do you believe I stood a chance, as a mere
    customer, to get the bank to use something else for the two factor?

    I really have no idea what you expect any suggested change to accomplish. Banks are likely doing more risk assessment on the alternative schemes than we have or the branch manager is able to do. IrCOve never had *any* form of MFA be anything more than a hassle, because IrCOve never had anyone get to/past the password challenge.


    Well, I expected a little bit more than complete apathy, but now I'm
    more experienced and know better.

    Then, if we're talking generally about MFA, and not specifically banks;
    I want to ask if you ever used Twitter before Elon? They had this great
    idea to implement 2FA with SMS services, except they also implemented
    password reset with the same SMS number.

    So now you had less secure 1FA with extra steps. And everyone here in sci.crypt should know about the ability to duplicate SIM cards with the
    right hardware on hand. I believe the criminals who do/did this don't
    even need physical access to the original SIM card.


    Happy security!
    --
    Johann | email: invalid -> com | http://www.myrkraverk.com/blog/
    I'm not from the Internet, I just work there. | via Easynews.com https://bsky.app/profile/myrkraverk.bsky.social | for ( ;; ) _:;
    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Ben Bacarisse@ben@bsb.me.uk to sci.crypt on Mon Aug 10 22:49:55 2026
    From Newsgroup: sci.crypt

    Thanks, everyone. Replying here because it's the freshest post and I
    have a few words to say...

    Rich <rich@example.invalid> writes:

    Ben Bacarisse <ben@bsb.me.uk> wrote:
    I don't use Usenet much these days (so forgive me if I am not prompt to
    reply) but I've just come across a sci.crypt adjacent question.

    My bank offered to allow me to log in today using my "memorable data"
    (MD) rather than my password. This MD is just a string you can choose
    and it is essentially arbitrary. They hope you will make it longer than
    a password but easy to remember.

    So far so good. I thought (when I signed up years ago) that this MD
    would be used as an extra, in person, check over the phone. But the
    login page prompts for four selected characters from it, for example the
    2nd, 5th, 6th and 12th. How does the server check these without storing
    the MD in plain text?

    They /could/ be doing what Richard suggests, but I agree with Richard's final conclusion, they likely are not hashing anything and likely
    storing the "memorable data" as plain text.

    Of course they /could/ be doing anything (!) but hashing each letter is
    close to pointless. It would stop the DB admin from see the plain
    text, but that's about it. If the data was leaked, recoving the
    MD would not be at all hard.

    On the other hand, there /is/ one way they could be 'hashing' it, and
    if so that means this becomes very very insecure.

    You given them "correct horse battery staple" [1] as your memorable data.

    They "randomly" [2] select indexes 3, 6, 12 and 17 (ones based, as most normal humans don't label the "first" character as character zero).

    That gives r c s t (if my index counts have been correct) from this memorable data.

    They combine these four into "rcst" and hash and store that hash.

    And... every time you log in, they always ask for indexes 3, 6, 12 and
    17 from your "memorable data".

    Which means, /if/ this is what they have done, then they now have
    everyone using a "four character" password due to their own
    incompetence. Not good.

    But I could see some "bank type" thinking this was an "unbreakable
    password" system much like our old crank with his Ada code systems used
    to think every one of his schemes was uncrackable.

    OK, but I doubt he could even get a job in IT, much less bank security
    IT.

    I'm not so very sceptical about "bank types". I think they employ
    people who at least know the current best practice. Given the potential exposure and litigious nature of insurance firms, they would, I think,
    take more than just basic care with hiring.

    Of course, if anyone know different, let me know!

    So, let us know if they ask for different index positions with each new login, or if they always ask for the same set of indexes?

    They do. Not always the same.
    --
    Ben.
    --- Synchronet 3.22a-Linux NewsLink 1.2