Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

Ever since I heard about programming, I was told that any password (especially the one used on login) should be stored in database using any kind of one-way hashing algorithm, and never ever as plain string. So, it can't be read directly from database, using any method.

Today I noticed that my bank (country department of Citi Group) is using my account (login) password to password-protect PDFs generated at the end of each month.

I'm curious: Are they breaching one of the most important security issue and are storing passwords in plain text in DB? Or is there any way to use hashed password from DB to password-protect generated PDF?

As far as my limited knowledge tells me, this isn't possible. And to use in PDF the same password as on login, it has to be actually read from DB upon PDF generation, which leads to a conclusion, that it is being stored there as plain text string.

This is a general question, on concepts of programming, not related to any particular language or technique, so I assume, it should be asked here, not in StackOverflow.

share|improve this question
1  
I was wondering the same thing. My bank, when I forgot my PIN, sent it out by paper-mail in clear text. They must have it stored somewhere to be able to do this –  Charlie boy Jul 30 '12 at 7:23
1  
Your understanding is correct. The hashing algorithm are pretty difficult to reverse engineer. Storing passwords in the db using hashing can be considered as a "good practice" but i don't think there shall be any body which enforces your bank in doing so. So since your password is put into the pdf delivered to i feel mostly your bank is not having hashing implementation but might be using some other cryptographic function to get the job done. –  Sameer Patil Jul 30 '12 at 8:55
4  
If you don't get any answers here, the folks at security.stackexchange.com might be able to help. –  Anonymous Jul 30 '12 at 9:04
add comment

1 Answer

up vote 3 down vote accepted

There is nothing within your scenario that says the organization is storing passwords in plain text.

There's a number of options I can think of off-hand.

  • They could be relying upon the encryption capabilities of their database. This is reversible and would make your password available for other encryption.
  • They could be running their own encryption algorithm (either symmetric or asymmetric) over the password to secure it. Again, this is reversible.
  • They could be storing your password during your login session and using that to generate your end-of-month PDF files. Not a great idea, but it would make your password readily available. You don't necessarily know when those reports are generated. Could be a just-in-time scenario based upon your logging in.
  • They may also be using the same hashing mechanism that encrypted PDFs use, so they only need to use the hashed result in order to encrypt the PDF. This would require a bit more effort on their part, but isn't completely implausible.

Or maybe they are storing it in plain text somewhere.

Don't jump to conclusions without gathering enough evidence to properly analyze the situation. I would say that in this case there are a number of paths that they may be following that would leave your password secured but still provide the ability to encrypt your reports with your login password.

share|improve this answer
    
Thanks for your detailed answer. That was something, I was looking for. I agree that my conclusions could be a little bit radical, but the general goal was to get answers (like yours), not to make any statements myself (as I'm not enough experienced in this area). –  trejder Aug 1 '12 at 12:11
1  
However, reversible encryption is nearly as bad as plaintext when storing passwords. –  user606723 Aug 5 '12 at 19:05
    
@user606723 - yes and no. One way hashes can be broken as well, it just takes longer. AES-256 has been so far impervious. All decisions are ultimately a balance between security and ability to be used. The right approach requires multiple facets, but that wasn't the subject of this question. –  GlenH7 Aug 6 '12 at 11:23
    
"One way hashes can be broken as well, it just takes longer." what do you mean? –  curiousguy Aug 6 '12 at 16:13
    
@curiousguy - For the stronger hashes, it can be done through using rainbow tables or brute force guessing. Mode du jour is to cluster a bunch of GPUs and have them start calculating hashes until the matching one is found. Other hashes have been found to have problems within the hashing algorithm so they can actually be reversed directly. –  GlenH7 Aug 6 '12 at 16:48
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.