UK bank pulls down pants password

Stephen Withers
Monday, 01 September 2008 10:56

Your IT - Home IT

What seems odd to me is that the password change came to light when a bank staffer told Jetley that the password he had given did not match the one on the computer. Whenever I've used phone banking, the password is entered into an automated system via the keypad before speaking to an agent.

How much security does a spoken password provide when anyone within earshot can hear you say it?

Furthermore normal practice for storing passwords is that you don't store the passwords themselves. Instead, a hash is calculated by applying a non-reversible function to the password, and the result is stored.

That way, you can be confident that the correct password was entered, but providing the function is sufficiently strong and the passwords are of sufficient length and complexity, there is no practical way of determining a password from its hash.

So, have you ever had an inkling that staff at your financial institution are able to see your password?