High-performance employees need quieter work spaces - <AUTHOR> https://qz.com/936077/high-performance-employees-need-quieter-work-spaces-but-companies-arent-making-the-effort/ <comment><USER2> The obsession for open plan offices continues to amaze me. Companies that invest huge amounts in staffing and other strategic programmes don't seem to spend much time challenging the default suggestion that 'openness = collaboration'.

This article mentions high performance employees - but most knowledge workers (designers, programmers etc.) that I know _all_ struggle with open plan office environments irrespective of their performance level. If anything, an open plan office is maybe less worrisome to the more executive people I know - their core work processes of communication & meetings are less negatively impacted by the inability to regularly get large blocks of quiet productive space.

Some companies obviously get this need (e.g. FogCreek) but it really feels like sugar consumption or smoking. Once people really interrogate the status quo they are quick to realise how negative it is - but despite this the sub- optimal default approach has an unbelievable amount of momentum.

My condolences to all the 'high performance people' surveyed who are desperately wishing for less disturbed work spaces!

<comment><USER3> Our company is currently relocating to new office, and they want an open office plan in the space. We will pack in tight, and our cube walls will all be 3.5 feet high. We have adjustable standing desks that will coming with us, so when standing we will towering over every one and I already know it's going to be awkward for me.

The best part is our 5 person IT team will be right next to 25 people who work phones for customer service.

<comment><USER4> Be lucky you have cube walls. Many open plans don't even have those!

<comment><USER5> 3.5 feet is barely higher than a desk (a normal one). That's like leaving your waiter a penny tip.

<comment><USER6> Yeah, but at least people can't see your junk on "wear a kilt to work" day...

I get that for a startup money is tight. Instead of telling employees:

"You folks really deserve a your own offices but we just can't afford it."

Instead they tell you the big lie; that they are doing it because it "increases collaboration".

<comment><USER7> If money is really that tight, you can just have people work from home. That's a lot cheaper than renting commercial office space.

</comment></comment></comment></comment></comment></comment><comment><USER8> Rubbish. It is exactly through their ability to "soldier on" in spite of intense and sometimes challenging surroundings that high-performing employees distinguish themselves as such.

And on top of this, remember that the other way your best performers distinguish themselves is in the fact that they most definitely are not complainers. So if any of your employees start yapping about your proposed move to an open plan environment (or even have the temerity to suggest that if you are going to have an open plan environment, people at least "try to keep down their voice down a bit"), then congratulations -- you've just identified an employee that's definitely not right for your organization, and will likely because more trouble and distraction for your team down the road -- for as long as you keep them on board, that is.†

† Of course I'm being facetious. But this but a slightly cheeky paraphrase of the _exact_ logic I've actually had used on me, to my face, to justify not just the hyperdense, pack-em-in-like-it's-veal-slaughtering-pen office plans which are apparently a peak popularity, these days -- but a whole range of obnoxious environmental factors --- e.g. loud TVs, loud muzack (or _any_ TV or muzack in "the pen", for that matter); or just loud, gratuitously chatty co- workers -- in plenty of environments I've had the misfortune of being stuck in. Until I realized I just wasn't "a fit" for these places, that is.

<comment><USER9> You got me. I was reading and thinking, "This person just couldn't be more wrong." Nicely done.

</comment></comment><comment><USER10> I guess that I fall into this characterization. Over my 36-year career, I've sat in solo offices with doors, shared offices, cubicles with progressively shorter walls, and wall-less high-density desk arrays. I've easily been twice as productive with a door as I am in a noisy environment -- all the other arrangements _suck_ if there is even one inconsiderate human in the space making a phone call, moving a pound of mucus from one sinus cavity to another, playing desk bongos along with their headphones, or any of the thousand other ways that normal humans can be distracting.

Good headphones help, if only to take control over my own distraction, but honestly this is a _management_ problem. If you want me to be extremely productive, and my productivity is a function of my ability to concentrate, then please just allow me to concentrate.

<comment><USER11> I do wonder why I have to purchase good headphones and wear them to combat this problem?

What are the long term impacts of wearing headphones? bacteria growth and hearing loss? Can't be good for my health long term.

Flow is a state of concentration, breaking flow take a longtime to get back in, shouting questions across the room is a context switch and not an asynchronous choice for me if I'm in the middle of something important.

The one inconsiderate person is the worst. The person unaware that their constant sniffing of mucus is awful. Usually the least intelligent person in the office IMO.

Usually the loudest and most obnoxious member of every team I've worked for seems to have the most production problems....coincidence?

<comment><USER12> You may find it hard to find audiophile headphones that suppress voices adequately. I had better results with ear muffs from the local hardware store intended for leaf-blowers. Get the biggest, ugliest ones you can find.

<comment><USER7> I have some of these that I use for lawn work, which are designed for shooting guns. They isolate sound pretty well, but they're also not terribly comfortable. They're OK for driving around on my lawn mower for 30 minutes, but there's no way in hell I'd wear them for 8 hours.

</comment></comment></comment></comment><comment><USER13> Article has been removed. The original source ([https://hackernoon.com/58-of- high-performance-employees-say-...](https://hackernoon.com/58-of-high- performance-employees-say-they-need-more-quiet-work-spaces-4381241a6453)) appears to be a PR piece.

<comment><USER14> From the original one:

"→ Are you a high-performance employee? Please help me better understand you by contributing to a 30-second anonymous survey. Thank you! [http://bit.ly/high-performance-survey](http://bit.ly/high-performance-survey) ←"

This can only be a joke...

</comment></comment><comment><USER15> Not much discussion of the anonymous survey - are these "High Performing Employees" Self selecting?

My gut says quiet spaces are a boon to productivity - but why not prove it instead of a research methodology with holes so large I could drive a truck through them.

<comment><USER7> Who's going to pay for the research to prove your idea that quiet spaces improve productivity? Especially when all the current consultants are hyping open-offices, which aligns nicely with managers/executives who want to save money on floor space and cubicle furniture so they can get bigger bonuses?

</comment></comment><comment><USER16> I made the mistake of thinking "open plan" meant low-walled cubes. Because I've been working longer than this fad existed. I think we had even used the term back then. I didn't get why people were suddenly whining about them.

Then I saw a real "open plan" office.

Holy shit. Why aren't workers violently revolting?

<comment><USER17> Being able to yell across the room while sitting down is more efficient than having to stand up first. Efficient collaberating.

This is a good metric. It's also the only metric we track. Science!

/s

What you are referring to is a "cube farm." Businesses have somehow discovered how to make working conditions worse.

<comment><USER18> Ironically, part of the reason for the ascendancy of the open plan, was the popular negative reaction against cubicles. Cubicles were so Dilbert, so 80s/90s IBM/Microsoft/Intel, so "Office Space." OK, maybe they didn't capture the imagination of every special unique snowflake who would've rather been extreme kite-para-heli-wind-surf-skiing. But at least it was a wall. At least it was a space.

<comment><USER17> The best method (for maximum sustained productivity) I've experienced is 2 developers to an office. For me, it's actually best if the developers aren't on the same team so they won't often interrupt each other. Either way is better than a cube farm and certainly open office. It's significantly cheaper than an office per developer, but nearly as good.

It's great to collaborate and all, but that should be done at a scheduled time in a scheduled place.

The negatives of open space is why libraries have a STFU rule.

<comment><USER16> I've had that arrangement before too, and it wasn't bad.

</comment></comment></comment></comment></comment><comment><USER19> The source for the claim in the title is:

 _> My latest anonymous survey shows that 58% of HPEs need more private spaces for problem solving, and 54% of HPEs find their office environment "too distracting."_

Seems kinda weak.

</comment><comment><USER20> Why do we think that we need only _one_ kind of workspace that meets _all_ of our criteria? Can't we have an office with a variety of different workspaces that we can move between as our needs change?

<comment><USER21> _Can 't we have an office with a variety of different workspaces that we can move between as our needs change?_

This would require companies to invest in their people beyond "Here's your paycheck, here's your healthcare, be glad we're giving you this much". Granted, some companies do-and some probably do come with a variety of workspaces. I used to work at one, but I don't know how many people would answer in the affirmative if polled how commonplace they expect that sort of workplace to be.

<comment><USER22> Healthcare? Hell, we just had our dental insurance dropped. Healthcare is now a $10k OOPM at rates 3x what they were 10 years ago.

The open office plan could work with tall, fabric cubicles. My place now uses short, glass & aluminum ones. Not to mention people chit chat too much. I'm an EE and have to think about complex stuff; I can't think with the chit-chat; breaks my squelch.

Fortunately I have a lab I can retreat to. Thinking about moving in there permanently.

<comment><USER23> Those fabric cubicles absorb a lot of sound. I miss them.

<comment><USER24> Cubicles where original marketed as "Action Offices" there is a book on the history of them called Cubed: A secret history of the workplace.

The creator of them came to regret his creation as they where subverted in a direction he never expected.

I've often wondered what a modern cubicle if designed today would look like, we've done wonders in computer modeling and such since even sound dampening designs would be much easier.

<comment><USER21> A desk with a single wall in the front, behind where your displays would sit, and a frosted glass pane demarcating rows. "We're not an open design", but you don't exactly have anything remotely resembling a private workspace either.

</comment></comment></comment></comment></comment></comment><comment><USER25> > We need to understand high-performance employees based on what they are > tasked with and their core principles, not how much they produce, or even > worse on standardized personality traits.

So high performance employees are whoever thinks they're important enough to be one?

<comment><USER26> I am assuming it isn't people stacking shelves in a supermarket.

<comment><USER27> I miss that, i worked evenings when the recession had just hit. plenty of room to think while you stack shelves on autopilot.

</comment></comment></comment><comment><USER28> There's no mention of the bare fact that:

      * Cubicles are 'furniture' and therefore receive advantageous tax treatment (accelerated depreciation, increasing profits),

      * Walls, not so much.

<comment><USER29> Just build floor to ceiling thick walled cubicle, getting the benefits of both sides.

<comment> lloyd-christmas And then you're in a dungeon with no natural sunlight. Glass helps, but it still feels like a prison.

</comment></comment></comment><comment><USER30> Imagine how many more "high-performance"[0] employees you'd have if it were quiet.

[0] Really? That's what they're called now?

Also:

"This article was published inadvertently."

</comment><comment><USER31> I work an odd schedule that includes 10 hours on Saturday. I _could_ work from home on Saturday, but almost always work from the office as I've got the place to myself (bad weather notwithstanding). It means driving 30 minutes each way, as well as everything else with going out to work. The peace and quiet is priceless as I've got an essentially empty 6 floor building all to myself. Security passes by once or twice during the day. Generally there are no phone calls, no meetings, no messages, no one stopping by to interrupt me. I can go on a think walk and - get this - think.

If instead I work from home on Saturday, I am interrupted each time I leave my "cave" to get a coffee. Sometimes it's my daughter, sometimes my wife. The phone will invariably ring and will either be a spam call or a call for one of them. There is no opportunity for a think walk.

<comment><USER7> >The phone will invariably ring and will either be a spam call or a call for one of them.

Simple solution: get rid of the phone. Why do you have it anyway? I haven't had a landline phone for probably 10 years now, and I was a little late to that party. This line of yours looks like something out of the 1990s: a phone call for _someone else_? How quaint! Do these people not have their own phones?

</comment></comment><comment><USER32> I get page not found?

<comment><USER33> The link now shows "This article was published inadvertantly"

<comment><USER34> I like the new version better. Now it sounds like a QZ staff writer who's disgruntled about their noisy open office.

</comment></comment></comment><comment><USER35> One open plan work environment story. One and only. Lasted three months there. Noisy, smelly (kitchen nearby), and the head counters would come by every couple hours to see who was at their seat and who wasn't. You don't have to be uber employee to fail to appreciate the master plan and want out of this type of thing.

</comment><comment><USER36> My current office has 475mm high dividers. Next year they plan to relocate us to the 'workplace of the future' with barriers that in some instances are sub-300mm. They have 3 setups - a 4x desk each getting a 90 degree partition, a 3x each getting 120 and a 6x flat rectangular thing with no dividers. We will all be expected to hotdesk (what happens to my desktop workstation is anyone's guess?) and will get a single ultra-widescreen attached to a laptop dock (bye productivity gains from 2 monitors). Each of the configurations has less overall desk real estate which is going to be fun when we have to roll out A0 drawings.

I already get constantly distracted and find it hard to work. I'm placed next to a corridor just near where one of 3 entryways from the foyer into the office area is. Previously, I was next to 1 of 2 printers, at a junction to a hallway holding the toilets, which doubled as a spot for people to strike up conversation. I rarely get any extended periods of focus here which is infurating when my job is structural analysis, maths, etc. We are currently given a grand total of 8 meeting rooms per floor (200+ people), most of which are permanently tied up with meetings so you can't even use them for private workspaces. This is something they claim they'll fix in the new office but in reality you will be lucky to get one.

The new place sounds and looks (when I checked out their examples of the desks) like it's going to be a nightmare even worse than this. At least here I can sort of sink into my seat and fall below the dividers, and at least I also get my own space as a desk that I can customise to suit my own needs/ergonomics/etc. and have it feel like it's my own space where I have some miniscule hope of focusing.

I'm already polishing my CV in anticipation of bailing because of it.

<comment><USER7> >My current office has _475mm_ high dividers. Next year they plan to relocate us to the 'workplace of the future' with barriers that in some instances are sub- _300mm_.

>I'm already polishing my _CV_ in anticipation of bailing because of it.

Crap, it looks like this infection has spread to Europe too. :-(

I really wish Europe would stop copying all the stupidest ideas and trends from America.

<comment><USER36> Don't worry, I'm in Australia.

Also not sure how my original post got downvoted since it's just recollecting my opinions on open-plan offices. Maybe the Open Plan Cabal hates me speaking ill of their utopia. Go figure.

<comment><USER7> Oh, I saw the millimeters and CV and assumed you were European; sorry!

Anyone from Europe care to comment on whether this plague has spread over there too? From what little I've read, it has.

I think, unfortunately, open-plan offices are just now the reality world-wide. Some cultures always had them (Asia), and now the cultures that had closed offices have moved that way. The US has led the world for a long time with software development, which does coincide with closed offices and then cubicles, so I think we can look forward to being a has-been and other countries becoming the leaders in software due to us adopting open-plan offices. In a couple of decades it'll probably cause a complete economic collapse and probably breakup of the US.

</comment></comment></comment></comment><comment><USER37> The most obvious and effective sounding way to divide offices is per-team. That way groups of people working on the same thing can talk easily.

My current company has every dev and most managers in the same room. 7 scrum teams, over 60 people in one room. It's madness and I can't fucking stand the noise.

You get written up for talking "excessively" during work hours because 3/4 the company can hear you when you try to collaborate. Peer programming is impossible.

I have no idea why idiotic management consultants are promoting whats basically a sweatshop environment.

The stupidest part of this is that my company just cut the walls down to a few feet. You can clearly see that the dividers between each team used to be full height walls. What a tragedy

<comment><USER38> uh well, you still work there don't you? that's why. because it's cheaper and you still need the paycheck.

<comment><USER7> Username checks out.

</comment></comment></comment><comment><USER39> Diversity, mixing departments in the name of collaboration are all at fault here.

Walls just make things better.

</comment><comment><USER40> No Shit, Sherlock !

</comment><comment><USER41> I find it very odd that these articles make the front page of HN on an almost daily basis. I'm currently working at home with twin toddlers with chicken pox playing at full volume, yet I'm having little trouble concentrating. Why do techs seem to obsess over this so much?

<comment><USER42> There are other factors besides just volume. I find it easier to concentrate in a cafe than I do in the office and it's not exactly quiet in the average coffee shop. What people are talking about around you also has an impact. The conversations in a cafe for example just seem to blend together and become a sort of white noise.

The discussions in the office however are sometimes related to what I'm working on. So hearing bits and pieces of them stands out in my mind and can get me thinking about that instead. People in cafes are also very unlikely to come up and tap me on the shoulder and start asking questions about completely unrelated topics.

YMMV of course and some people concentrate just fine in loud places. On the other hand the people that say "I don't mind the open office plan, it doesn't bother me" might just be the people who are disrupting everyone else.

<comment><USER7> There's another factor to the coffee shops IMO: who the people are.

In an open-plan office, the people around you are usually your coworkers, the people you see every day and know personally. In a coffee shop, they're usually total strangers, people you might see occasionally at that shop at best, and very likely you'll never see them again.

Also, the strangers at the coffee shop don't care what you're looking at on your laptop, or if you're getting any work done. Coworkers might. Also, strangers at a coffee shop are unlikely to interrupt you; coworkers are very likely to. So at the coffee shop, it's entirely possible to be around other humans without being forced to socialize with them, but not at work.</comment></comment></comment>


Linux Kernel Tuning for C500k - <AUTHOR> http://blog.urbanairship.com/blog/2010/09/29/linux-kernel-tuning-for-c500k/ <comment><USER2> Some other tricks that were not touched upon in the article, but which may apply depending on the nature of your traffic:

1) If you have lots of short connections and you want to tune the amount of time that the kernel will keep half-closed connections around then you can play around with changing the values of net.ipv4.tcp_fin_timeout, net.ipv4.tcp_tw_reuse, net.ipv4.tcp_tw_recycle, and net.ipv4.tcp_max_tw_buckets.

2) If you have a modern NIC then you probably need to tweak the txqueuelen in your ifconfig options.

3) If you are get hits from a large number of random browsers then sometimes setting net.ipv4.tcp_no_metrics_save and net.ipv4.tcp_moderate_rcvbuf to turn off cacheing of flow metrics helps.

4) Increase net.core.somaxconn to increase your listen queue size.

5) If you have a local firewall like iptables in place make sure you increase net.ipv4.ip_conntrack_max, direct your high-traffic ports to the NOTRACK table, and play around with all of the various net.ipv4.netfilter.ip_conntrack_tcp_timeout_* settings.

<comment><USER3> Good tips. The only thing I would recommend against is setting net.core.somaxconn too high - a too large backlog at a time when your server is already resource constrained might just push it over the brink.

</comment></comment><comment><USER4> I tested one server up to 1 million concurrent connections a couple of years ago, search for sysctl in this article to see the settings I used: [http://www.metabrew.com/article/a-million-user-comet- applica...](http://www.metabrew.com/article/a-million-user-comet-application- with-mochiweb-part-3)

</comment><comment><USER5> Just a technical note on the 64K myth section. My understanding is that TCP connections track by the tuple (remote_host, remote_port, local_host, local_port) so a single client can have 64k unique connections to each port on a remote machine.

If that is actually the case, the document gets its myth correction wrong (by a lot) :)

Can anyone clarify this?

<comment><AUTHOR> You are right. The part I didn't really make clear is that we only serve on the single external port. Were we to use multiple, then yes, we could have 64k * 64k per IP pair.

<comment><USER5> Ahh -- that makes sense. Thanks for clarifying.

</comment></comment></comment><comment><USER6> This isn't relevant to newer kernels as these settings are dynamic based on memory size since 2.6.26ish - The kernel will set this based on usage no need to tweak. The only real issue is making sure you buy a high end network card that will offload as much as possible to avoid x context switches per second (I don't know what it is exactly with netpoll).

</comment><comment><USER7> My, how things have changed since the C10k problem...

<http://www.kegel.com/c10k.html>

<comment><AUTHOR> The C10k solutions are effectively the same as for C500k, those being epoll (Linux), kqueue (BSD), etc. Our Java NIO server utilizes epoll to handle C500k.

<comment><USER8> What Java NIO server utilizes for EINTR? ^_^

</comment></comment></comment><comment><USER9> Interesting post, thanks for sharing!

About the suggested sysctl.conf settings: I think you'd also need to adjust _net.core.rmem_max_ and _net.core.wmem_max_ in order for the _net.ipv4.tcp_rmem_ and _net.ipv4.tcp_wmem_ settings to be effective.

Furthermore it couldn't hurt to increase _net.core.netdev_max_backlog_ , which is the maximum number of packets queued on the input side, when the interface receives packets faster than kernel can process them.

<comment><AUTHOR> Regarding the `net.core` parameters. We do modify those, but my assumption (probably wrong) was that the `net.ipv4` changes would override the core configs. I'll take a look and update the post. Good point about `netdev_max_backlog`, I need to read up on that one too.

Thanks for the feedback!

<comment><USER9> I'm playing around with the exact same things -- maximum concurrent tcp sockets on Amazon EC2 large instances.

How many did you get running?

<comment><USER10> We got over 500k/instance: [http://blog.urbanairship.com/blog/2010/08/24/c500k-in- action...](http://blog.urbanairship.com/blog/2010/08/24/c500k-in-action-at- urban-airship/)

</comment></comment></comment></comment><comment><USER11> Linking this with the IPv6 stuff currently on the front page: note that none of this would be necessary if the clients were running IPv6 (or otherwise un- NAT-ed) - the server could simply send them a UDP packet or even open a TCP connection.

</comment><comment><USER12> This is interesting stuff. I jumped into node.js programming a while ago and will like to run similar tests on node.js. Can anyone tell me how client side load of 500K long lived connections achieved ? Is there a standard set of programs to achieve this or some custom scripts.

</comment><comment><USER13> Did somebody solved C1000K (or C1M) problem?

<http://news.ycombinator.com/item?id=1755575>

Is maximum number of connections that you can reach on largest EC2 instance is the same as on physical server?

</comment><comment><USER14> I'm wondering what are the major side effects of this. Hmm?

<comment><USER10> A good question. Shrinking TCP buffer sizes can have a negative performance impact when sending large amounts of data; our use case was keeping track of a large number of mostly silent connections, and so we benefit from the smaller memory footprint.

</comment></comment><comment><USER8> btw, the most common source of high load is (surprise!) disk I/O.

So, moving a /var/log (not just /var) on separate device connected to distinct controller port is a big deal.

If you're running, say, mail server, you should separate /var/spool and /var/log and /var/db/mysql if any.

Partitioning, serious network card (think Broadcom) and big CPU caches are good things to begin with.

<comment><USER15> Broadcom on Linux?! I was under the impression that their drivers aren't too good or open source friendly.

</comment></comment><comment><USER8> LOL! This is called tuning nowadays?

Even Oracle providing much more good advices, let alone some individual pros.

Good starting point: <http://www.puschitz.com/InstallingOracle10g.shtml>

Update: Oh, yes, I understood. Newfags doesn't know what Oracle is. MySQL = RDBMS, I see. ^_^</comment>


Topicctl – an easier way to manage Kafka topics - <AUTHOR> https://segment.com/blog/easier-management-of-Kafka-topics-with-topicctl/ <comment><USER2> Segment employee here. Our Kafka runbook looks 100X cleaner after this tool was rolled out by Ben and folks. One of my favorite parts is how it makes dangerous things harder :)

<comment><USER3> Is there a reason you chose not to use ACLs? We did enable them, but it feels like it is causing more headaches than any security benefit it might provide...

<comment><USER4> I guess we just haven't got the need to use ACL yet. This may be something we will look later on. We have been started to implement what's needed to leverage things like SASL in our instrumentation but we are not there yet (see [https://github.com/segmentio/kafka-go](https://github.com/segmentio/kafka- go)).

</comment></comment></comment><comment><USER5> Thanks for this! Managing Kafka and topics can be messy at times, so a really welcome addition to apply more robust Kafka changes.

</comment><comment><USER6> > Replica placement strategy

This is huge, currently you have to manually specify placement for all replicas when you increase the replication factor for a topic. Do this for many topics and it quickly becomes very tedious and error-prone. Thanks for this, I'm very excited to try it out!

</comment><comment><USER7> """Many of these were shaped by our experiences making AWS changes with Terraform and Kubernetes changes with kubectl. We wanted an equivalent to these for Kafka!"""

so use this topicctl for advanced topic changes.... and the more primitive kafkactl[1] for basic stuff?

What about the 10 or so other GUI managers like this one? [https://github.com/cloudhut/kowl](https://github.com/cloudhut/kowl) [2]

[1][https://github.com/deviceinsight/kafkactl](https://github.com/deviceinsight/kafkactl)

[2] [https://news.ycombinator.com/item?id=24099037](https://news.ycombinator.com/item?id=24099037)

<comment><USER8> Author here, thanks for the comment. topicctl is really motivated by a desire to support rigorous, git-based topic management. The read-only views (tailing, repl, etc.) are secondary to that and are useful for our command-line-based workflows inside Segment, but are definitely not intended to replace all of the other good tooling out there, including the ones you've referenced.

</comment></comment><comment><USER9> kafka-gitops [1] is another declarative topic/acl management tool that enables a planfile/apply strategy.

[1]: [https://github.com/devshawn/kafka- gitops](https://github.com/devshawn/kafka-gitops)

</comment><comment><USER10> That looks very interesting! About managing YAMLs like we'd do with kubectl as explained in the article, how does topicctl differ both in concept and operation from Strimzi's Kafka Operator for Kubernetes? I know, they are a different company etc but that Kafka operator is gitops-friendly and everything so I'm honestly trying to compare them as managing Kafka is a REALLY HARD problem, so kudos for trying to make it easier!

<comment><USER4> At Segment we manage clusters which are both on ECS and EKS. We didn't want to tie our Kafka management to the container orchestration.

If I'm right the Strimzi operator is also managing the brokers. Here we only focus on the topics.</comment></comment>


Let's not forget about SNI - <AUTHOR> https://foobuzz.github.io/doh-sni/ <comment><USER2> The only SNI that the ISP can see is the SNI of the DNS provider. The goal was to protect the DNS queries itself from eavesdropping and that is implemented.

<comment><USER3> Once the target IP is resolved and the actual request to the site takes place the ISP can see the SNI of the resolved host.</comment></comment>


Ask HN: A major USA bank is storing passwords in cleartext – what to do? - <AUTHOR> I was having trouble accessing my account, so I gave a call to customer service.  The service rep proceeded to (accurately) describe my own password to me.  Should I report this somewhere?  I'm not really sure what to do. <comment><USER2> It seems you're not getting serious answers here, so here's my take.

Please report this via the US-CERT at [https://www.us- cert.gov/report](https://www.us-cert.gov/report)

This will allow you to report it, eventually from an anonymous email address, without exposing you directly to the bank which might react bad to you. CERT can handle the coordination with the bank, this is what they do.

<comment><USER3> This very looks cool, thank you for sharing parent.

I apologize for the nitpick, but I hope there will be some guidance on what an "anonymous" email is.

(Ex: Guerilla at a public wifi like a library, an email created at a library, but not your usual email from a place other than your home)

I worry sometimes that we assume people reporting security vulnerabilities will be security experts.

I often meet people who are intelligent and technical, but either do not understand security, or understand it in terms of confidentiality, integrity, and availability (CIA triad) and flounder when thinking about anonymity.

<comment><USER4> An easier way may be to anonymously message a tech savvy media company or security firm, maybe via snail mail even. You can do it anonymously yourself but it'll take some work and a mashup of:

\- VPN service where you pay with cash (Mullvad) \- Temporary email (Protonmail?) \- One time use computer (cybercafe, pay with cash?)

There's layers you can apply like a TOR browser usage but it'll take more effort/learning.

<comment><USER5> Or you could email Troy Hunt

</comment></comment></comment></comment><comment><USER6> Really shocked at all the handwavy comments.

> "It's fine, there are more checks in place to prevent unauthorised > transactions"

> "Also, it's insured"

Well ok, that means the bank is protected, but what about my (sensitive) data such as transaction history?

> "If anyone does anything bad, law enforcement will step in"

Yeah, I totally trust a bank that can't even properly deal with something as basic as passwords to notice breaches reliably.

> "It would be too expensive to replace legacy systems"

And that's the consumer's problem?

I really hope none of you apologists are moving fast and breaking things at any company that is entrusted with people's personal information or is needed for more critical infrastructure of everyday life than cat pics and funny polls.

In Europe banks also don't like paying to replace legacy systems to maintain security, but such a failure to protect consumer data and privacy would be in serious breach of legislation and result in significant fines.

<comment><USER7> >> "If anyone does anything bad, law enforcement will step in"

>Yeah, I totally trust a bank that can't even properly deal with something as basic as passwords to notice breaches reliably.

As an example of this: Equifax. This happened in 2017, and not really much has happened and people haven't been prosecuted. So everyone got some identity theft protection for a year. That didn't solve the problem. Equifax lost a little money. So little changes. And the claim is that it is Chinese state actors that did this, so no one will get prosecuted (because we just let China attack us?).

So handwavy seems defeatist.

Also, if this is a major bank, then Equifax is a great parallel to draw from.

<comment><USER8> Link to the symbolic indictment - [https://www.justice.gov/opa/pr/chinese- military-personnel-ch...](https://www.justice.gov/opa/pr/chinese-military- personnel-charged-computer-fraud-economic-espionage-and-wire-fraud-hacking)

</comment></comment></comment><comment><USER9> As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incompetence, but simply the acknowledgement that the legacy systems will not enjoy PBKDF hash+salt+iterations columns being added 30 years after the fact.

The risk analysis and mitigation discussion for these institutions goes something like this:

1) We cant have good password storage so we will require a 2nd factor and attempt to ensure these systems reside in our most secure network.

2) There is nothing we can do, so we will simply rely on the fact that if someone logs into an account illegally, we send in the men with guns. For some strange reason when a bank calls the FBI things move with a high level of expediency.

There is much more to this than just the technical aspect of "oh my goodness why aren't you hashing your passwords". How much ripping would HN impose on one of these institutions if they attempted a 100% best practices secure password upgrade and then subsequently had a complete IT disaster unfold (I can certainly link articles). For many banks and other financial institutions, going down for even 1 hour is a complete catastrophe. If people can't get their money out right away, they are leaving for the competition and you will likely get dinged by regulators. Bad people will continue to do bad things until the end of time. Killing your business to handle every edge case, even if it seems obvious, is not a good path to go down.

I would also consider this: These banks' IT systems are storing things that many of us would argue are much more valuable than your passwords. A bank's core system also represents the actual monetary value of every customer's account. We are talking about password security in a system domain where there are arguably far more valuable assets to secure. These assets are already implicitly protected by a massive apparatus extending as far as Ohio Class nuclear submarines patrolling the Pacific ocean.

<comment><USER10> > For many banks and other financial institutions, going down for even 1 hour > is a complete catastrophe.

Are you joking? It's a common trope for bank websites to go down for "scheduled maintenance". Not to mention real-world bank branches keep bizarre hours and close for random holidays like Presidents' Day and Veterans' Day.

 _Why do banks and credit card companies need to perform "scheduled maintenance" during which users are unable to access their information online?_ [https://www.quora.com/Why-do-banks-and-credit-card- companies...](https://www.quora.com/Why-do-banks-and-credit-card-companies- need-to-perform-scheduled-maintenance-during-which-users-are-unable-to-access- their-information-online)

<comment><USER11> Even though websites are really important, I think they mean other business critical services going down for an hour.

Imagine if all credit cards with a company failed to process transactions for an hour, or depositing/withdrawing money didn't make a change to your balance. Those types of issues are much more severe than a customer not being able to log in to the website.

<comment><USER12> You know, those kind of things already happen. Even I sometimes had issues with my credit card when paying online and usually there's another way or you could just pay an hour later.

<comment><USER13> Really? I've never experienced my credit or debit card not working (except in America where my Canadian debut card often will just not work)

</comment></comment></comment></comment></comment><comment><USER14> Name and shame. I'll start:

American Express passwords are not case sensitive.

It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.

<comment><USER15> Lol it's been that way for at least 20 years. Same with chase (well at least the bank one half of it).

It seems remarkably stupid, but it's way cheaper for them to refund any losses and/or pay for lifetime credit monitoring than it is to deal with customer service calls from people getting locked out because they can't figure out how to deal with uppercase and lowercase letters.

<comment><USER16> It's funny that my small-ish credit union is not only more technologically advanced, but also way more ethical (looking at you, Wells Fargo) and convenient, and has top notch customer service. Seriously, I've never interacted with more pleasant customer service reps than my CU.

Why are people giving their money to big banks again? Is it just advertising pressure?

<comment><USER17> Well, 25 years ago, when I opened at $BigBank the CU I use now didn't exist, and $BigBank offered services and availability that CU didn't (in 1995). Then, for the very long time I tied so many things to that account at $BigBank that it took almost three years for me to migrate all the accounts, business and personal and loans, etc to the new CU.

So, to why: legacy and stickiness

</comment></comment></comment></comment><comment><USER18> > The service rep proceeded to (accurately) describe my own password to me.

Wait, that _alone_ doesn't necessarily indicate that they're storing clear text passwords. I notice you didn't say that they just repeated your password to you-- why do you think they store the whole thing in clear text?

HN readers are apt to demand hardcore passphrases, salting, 2FA, etc. But the reality is that banks have to deal with all kinds of people and situations. Your security as a bank customer hinges on more than just one password, it's also about monitoring patterns of behavior, being aware of what's coming and going from your account, and protection mechanisms like the bank's insurance.

That said, one would think that large institutions have learned their lesson about clear text passwords, perhaps this one hasn't? Is there a law against clear text passwords? How does anyone actually know if a financial institution has sound IT practices, by happenstance incidents like this? Really?

<comment><USER19> > Is there a law against clear text passwords

In Europe GDPR covers that, many big websites started hashing after it

Edit: could somebody explain the downvotes? The comments seem to agree with me

Obviously GDPR is not a law about plain text passwords, but as the comments say it forces "the use of an appropriate hashing algorithm to store your passwords, protecting the means by which users enter their passwords, defending against common attacks and the use of two-factor authentication." etc.

<comment><USER20> GDPR does not have any wording that refers to any technical specifics (e.g. password storage) whatsoever.

The most relevant passage is "the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk" from article 32; and it _could_ be argued that having passwords in plaintext most likely does not constitute "appropriate technical measures" and doing so opens you up to fines based on GDPR if an incident occurs, but it's not really "a law against clear text passwords" but rather a law that simply says that you are responsible for how you [mis]implement your security and the consequences of that.

<comment><USER19> Yes of course GDPR is not a law about plain text passwords, but (as the sibling comment points out), pretty much everybody considers the use of appropriate hashing as a requirement to to ensure a level of security appropriate to the risk.

[https://www.gamingtechlaw.com/2019/04/first-gdpr-fine- italy....](https://www.gamingtechlaw.com/2019/04/first-gdpr-fine-italy.html) this fine specifically mentions password storage (among many other things)

Also see previous thread on HN: [https://news.ycombinator.com/item?id=18531588](https://news.ycombinator.com/item?id=18531588)

<comment><USER6> On top of that GDPR requires companies to notify customers of data breaches, which risks reputation damage. Another liability of shoddy security.

</comment></comment></comment></comment></comment><comment><USER21> One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be _exactly_ 6 characters long(!) consisting _only_ of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password:

[https://banking.westpac.com.au/](https://banking.westpac.com.au/)

I complained to them about this years ago, they replied explaining they knew what they were doing and it was a balance between security and simplicity...

<comment><USER22> Even worse, a major French bank removed their perfectly fine password requirements and replaced it with a 6 digit PIN that you have to enter via an on-screen numpad. They explicitly block password managers from autofilling too! And I had just managed to get my parents to start using one.

<comment><USER21> Well Westpac had an onscreen keyboard for the password entry too until about 18 months ago. When they finally replaced it with a (thankfully password-safe friendly) text box they had this to say:

"At Westpac, we are continually striving to provide the highest quality service and security to help support our Online Banking customers.

From the end of May 2018, we will be removing the keypad from the online sign- in screen and replacing it with an open text box, which allows you to type in your Customer ID and password.

...

Security Guarantee. We assure you that using the open text box to enter your sign-in details carries the same high level of security ..."

Passwords remained fixed at 6 characters however.

<comment><USER23> The US treasury does/did this on-screen keyboard thing as well (at least up until I stopped needing to login to that website within the last year or two). The "best" method I had around it was to copy the password out of my manager, use developer tools to find the '<input type="password">' element, and add 'value="[paste]"' manually.

<comment><USER24> I used to bank with WestPac and from memory it wasn't possible to do this as they had some additional javascript running that would cipher every letter.

</comment></comment></comment></comment></comment><comment><USER25> You should report to proper authorities about the severity of the issue. Reach out to their security or technical higher up department of the bank.

In your case, they may or may not be storing the password in cleartext. They might be using the two way encryption instead of one-way hash. Passwords should be hashed (with salt) and it is irreversible.

For a financial institution, revealing your password by a customer service rep is a big red flag. I would reach out to concerned authorities and do a proper disclosure.

<comment><USER26> > You should report to proper authorities about the severity of the issue. > Reach out to their security or technical higher up department of the bank.

Switch your bank.

Do not reach out to the bank's security/technical! There's a non-zero chance that the response from the bank would be to reach out to the FBI and claim that you are the "hacker". It will create an enormous headache for you.

If you are going to reach out to anyone, reach out to the OCC.

<comment><USER27> [https://www.occ.treas.gov/](https://www.occ.treas.gov/) ?

<comment><USER26> Yes

</comment></comment></comment></comment><comment><USER28> Wow. Did they repeat your password or some hint you typed in a long time ago?

FWIW I have seen two companies that store passwords properly in a one way hash with salt but store statistics on every password like number of case changes and count of numbers and total length. I personally think that practice is infinitely stupid but can explain why they can say it has 3 numbers in it. One major marketing firm I did work for did that until we showed them why it was so dangerous. They were just trying to make users life easier but that wasn't a smart trade off.

Personally I would like to know which bank. I have accounts at a number of major US banks and if one I use is doing this I'll move everything out of them immediately.

Edit: to answer your question I'd hand the info to a major investigative news source and let them dig more. The FTC and banking regulators I don't think will get involved unless there was damage.

<comment><AUTHOR> They're a three letter acronym that starts with P and ends with C.

<comment><USER29> Wow, they should know better. That's really mediocre if true. Call the OCC consumer hotline which is listed at the following link [https://www.occ.treas.gov/topics/supervision-and- examination...](https://www.occ.treas.gov/topics/supervision-and- examination/dispute-resolution/consumer-complaints/index-consumer- complaints.html)

Tell them you'd like to file an "Official Complaint" regarding a serious cyber security issue at that bank, and to transfer you to whoever handles official consumer complaints regarding cyber security. Regulators are sensitive to the word "complaint" (specific wording matters) and typically require that complaints are stored, prioritized, and handled in a prescribed way.

Ask them if they can get back to you with any resolution and leave your contact information. Update HN if you're comfortable with that. Good luck.

</comment></comment></comment><comment><USER30> Genuinely curious, why not name the bank here?

It certainly isn't going to be news to the bank itself, so there aren't responsible disclosure concerns here.

And since the top advice here is to leave the bank, wouldn't the best thing you can do be to alert the public, so others can protect themselves as well?

<comment><USER31> Looks like it's PNC. Everyone here, move your money now.

<comment><USER32> Or don't make financial decisions based on vague anonymous internet comments until you've investigated for yourself.

<comment><USER33> Do you want this person to mount a full blast investigation on their own? Most banks are mostly interchangeable nowadays unless you live in a small town and there's only one bank you must use because you're transacting with cash. They pay nearly zero interest, and they treat their customers like trash with monthly fees galore.

<comment><USER34> Thank you, yes I will certainly change all my financial set up based on no further information these two alarming comments. Who needs to look further into things - they are all the same after all.

</comment></comment></comment></comment></comment><comment><USER35> Why not reach out to someone like Brian Krebs? He has a pretty large reach and can potentially make people take notice.

Try @briankrebs on Twitter.

<comment><USER36> Alternatively I feel like Troy Hunt may also be able to help

[https://twitter.com/troyhunt](https://twitter.com/troyhunt)

He runs the @haveibeenpwned service

<comment><USER37> Troy has actually covered a similar topic to this in the past:

[https://www.troyhunt.com/banks-arbitrary-password- restrictio...](https://www.troyhunt.com/banks-arbitrary-password-restrictions- and-why-they-dont-matter/)

His viewpoint seems to be that poor security practices around passwords in banks are not a big deal, due to the overall processes that banks use to prevent fraud.

<comment><USER23> I would tend to agree, for now, except that banks are doing their best to shunt responsibility for fraud onto merchants and customers. There are obvious financial incentives that will encourage them to continue trying to do so.

</comment></comment></comment></comment><comment><USER38> Can you explain what you mean with "describe my own password to me".

As other point out: maybe they store some things about your password like "has four digits, starts with an S".

This does not mean they store your password in plain text.

Everybody here starts shaming and naming but be very careful with that. Before you know it you shame a company while there is nothing going on.

</comment><comment><USER39> My bank just changed from a 6-number password (literally no option for more or less characters nor anything but digits) to rational passwords this month. I don't know how my WoW account 10 years ago needed an authenticator but the people managing my retirement savings didn't light a fire under asses to get that done.

Legislation should have and likely still should be put in place.

<comment><USER40> Your wow account security was done with post-2000 tech, your life saving account security still depends on 1970s mainframe rules.

I agree about the legislation part.

</comment></comment><comment><USER41> Hashing passwords has been ingrained into our brains as it's an easy way to reduce risk. That said, sometimes sensitive information needs to be stored in a retrievable format (subscription credit card processing comes to mind). Every data decision that's made has an element of risk involved while accomplishing an end goal. With the right processes in place (encryption, limiting access (auditing that access), decryption authorization), the risk can be reduced to an acceptable level.

I don't think we have enough knowledge of the risk and processes in place at this bank to say if it's an issue.

<comment><USER42> I think you're prematurely jumping to the defense of this bank. What we do know is that the customer service rep was able to read the user's password in plaintext. Even if there is a "legitimate" reason for storing in a retrievable format (probably due to compatibility with legacy systems) the fact that the customer service rep could access that password tells me they do not have appropriate access control.

<comment><USER41> Just to play devil's advocate:

What is a secure hypothetical way of granting access to an account when the customer lost access to their email and phone (so no pw reset or 2 factor authentication will work)?

The bank has to have other processes in place. They're not going to keep your money from you. Let's say they accept a driver's license as authentication or a debit card. These methods are way less secure than a secret password and _possibly_ introduce more security risk than a rep having access to view a password.

A bad actor rep could then [almost] just as easily get a fake ID created to get the same access the password would have granted. I'm also assuming that the password was completely visible, not just a truncated version.

This is the root of my concern of not knowing all the risks and processes involved. I don't want to jump to conclusions without knowing the whole ecosystem.

</comment></comment></comment><comment><USER43> Banking security is a joke.

My bank calls me to talk to me and insists I give them my date of birth and address to 'verify' myself.

Meaning anyone can call me, pretend to be my bank, I am supposed to give them this info, and then they have what they need to verify themself as me.

Banks are dumb.

<comment><USER44> I did some tech consulting with some ex-banking Wall St. consultants. It's not a monolith. That industry is very conservative.. and some companies get so frozen in time that they become complacent and go full Equifax. They're always playing catch-up because every criminal and most people would like to rob a bank without a gun, so their threats are numerous and perpetual. (And then there's Wells Fargo.)

It seems like banks should adopt that credit-file-based challenge protocol with the multiple choice questions containing ~50% or so spurious data that answers (None of these). I had to do it to reset a hospital's patient login for myself the other day.

DOB, SSN, address, phone number aren't secret-enough "things you know" or "things you can do." For signatures, I always sign a smiley face because they're completely worthless.

Perhaps even better would be to:

0\. have the bank have a relationship with the customer

1\. issue 2FA device or soft-2FA

2\. use per-customer colors, pictures and words on the password screen to deter impersonation and phishing attacks

3\. It seems like hardware is so cheap these days, the bank could issue customers a hardened tablet with a pin, biometrics & face recognition that VPN'ed back to them and functioned only for their banking apps. It's much easier to support and harden one controlled device than zillions of likely malware-infected Chrome on Windows 10 or macOS Catalina's Safari on unsecured public WiFi.

<comment><USER45> >2\. use per-customer colors, pictures and words on the password screen to deter impersonation and phishing attacks

I've seen this on multiple sites, and I always thought it was snakeoil. All you need to do to bypass it would be to make your phishing server contact tho bank to request the per-customer color/picture/word.

</comment></comment></comment><comment><USER46> Wells Fargo used to require that a new password be sufficiently different from an old password. e.g. if my password was "Madison111$" I could change it to "Madison222$" except that when I did so I would be prompted to change it again the next time I logged in. Since I always iterated on a version of my password this was an issue. The reason was explained to me when I finally called and asked why I was being required to change my password every single time I logged in. So, I changed Madison to Matthew and was good to go.

Not sure how they were doing that if they weren't storing the password in plaintext.

<comment><USER47> It is definitely possible to do that. When the user submits a password to save, it hashes it and saves it to the database. At the same time, it calculates x number of variations of the passwords, hashes those, and saves those to the database as well. The next time you go to update your password, the hash gets compared against the actual previous hash as well as the x number of hashed variations and if any match, it gets rejected.

Not super efficient and in most cases, probably not worth the effort. But completely doable to do.

<comment><USER48> How many variations will you store? It's very easy to calculate the Levenshtein distance on plaintext data, but basically impossible to enumerate all the variants and hash them.

</comment></comment></comment><comment><USER49> Something similar happened to me once. An e-commerce platform gave my wife my plaintext password. It was my "low security" password, the same one I used in dozens of sites. That's when I started using a password manager so now every site gets a different random password.

</comment><comment><USER50> It never ceases to amaze me what the state of online banking is around the world.

Here we have something called BankID which comes in two flavors, one that is a physical token that generates TOPT used to log in, either in a combination with a password or a PIN on the token device itself, referred to as BankID. And the other, much slicker solution, called BankID on Mobile, which runs as SIM-application on your phone where you digitally sign the login request using a PIN. The user can also verify the request visually on both the computer and phone using a unique keyword.

One killer feature with BankID is that you can use it to log in to any service that has BankID, like your insurance company, looking at your tax return, other banks, etc. This is perhaps the biggest issue with it since the system can get overloaded when there's a country wide rollouts of tax returns and such. This has become much better lately since they've started to roll out things like tax returns as soon as they're ready instead of doing bulk releases.

<comment><USER51> Sweden? Here (Baltics) we have SmartID or mobile signature or hardwire password generators (TOTP). No stupid passwords.

<comment><USER50> Norway, but I would imagine it's the same or same-ish solution given that banks in Scandinavia and Baltics operate more or less the same way.

</comment></comment></comment><comment><USER52> Move your money to a different bank.

Now that banks aren't paying useful interest rates they are mostly only tolerable for security and convenient access to your money. If they can't do those two then... what exactly are they for? Likely nothing.

<comment><AUTHOR> It's for an auto loan.

<comment><USER52> Be extra careful with your details associated with that account and anything it touches. eg any direct debits might "change" without notice. Enable all added security you can.

But realistically, there's no silver bullets. Refinancing can be expensive. Cost/benefit applies: Might not be worth refinancing just for this. Just be vigilent about the accounts involved.

I had a phone company that bragged about its security. So I tested them out. Yup they sent my password via text. Ok then. Contract was for six months. Not worth switching. But also not worth _renewing_.

</comment></comment></comment><comment><USER53> Since it seems this is PNC, I am one of those who now needs to find a new bank. Any recommendations? I used PNC for my checking/credit but already use an american express high yield savings.

I was thinking maybe Capital One?

<comment><USER54> Why? The compliance requirements don't require hashing (iirc, "commercially reasonable" protection is/was the standard), so you should assume that any other bank is doing the same thing, as they probably are.

All that is needed to steal your money is the bank account number, which you probably have mailed out or otherwise provided to numerous random third parties, who process them with other third parties. There's almost no information in there that isn't already available to anyone who cares to look.

A more reasonable approach that actually impacts your security would be:

\- Opt-out of electronic communication and get paper statements and account notifications. (This ensures that you receive notice, in the mail, about changes of address and other changes)

\- Opt-in to notifications about large transfers or low balances.

\- Disable Bill Pay features at the bank.

\- Disable external ACH transfers.

\- Request wire transfer privileges, which with some banks allows you to get a physical token to secure access to your account.

\- Use a dedicated PC/iPad/Chromebook/etc for your banking to reduce the risk of malware capturing your banking details.

If you're going to switch banks over this, look for a credit union small enough that they use an off the shelf banking solution, and figure out what the default configuration of the solution is.

<comment><USER53> Thanks for recommendations. I will admit I overreacted when I saw the headline and found out it was PNC. Just not the thing I expected to start my day hearing.

I already use 2FA, a unique password only with PNC and alerts on all account activity, including logins.

I will look into some of the things you listed!

</comment></comment></comment><comment><USER55> Fidelity's passwords map to characters on the phone keymap, e.g. the characters "j,k,l,J,K,L,5" can all be represented by the number 5 on the phone. Holy entropy, Batman!

<comment><USER56> I can attest to this. When you call in you just have to type in your alphanumeric password completely using the 10 digit phone pad. Just like in the 90s. On the other hand Fidelity has the best customer service I have ever experienced so I guess everyone has competencies.

</comment></comment><comment><USER57> Does anyone know if PCI rules call for non reversible storage of passwords (hashing)?

I looked quickly online but the only reference I could find was that "passwords are protected by strong cryptography in transit and at rest", which seems to allow wiggle room to store passwords in reversible but encrypted format.

</comment><comment><USER58> There is not much you can do, I've tried to inform banks of security issues in the past and all that happens is you get a form letter saying thanks for writing we are doing that on purpose for reasons we can't explain to you and we're not interested in outside help. Synchrony and Citibank, I'm looking at you.

</comment><comment><USER59> What does the password give access to? Full online banking (e.g. being able to do transactions?). Does login not require any further authentication beyond the password?

If the authentication still requires using some kind of good 2FA then it's less serious to have the password in plaintext. Still bad of course.

If this is for some other service that doesn't let you do any transactions then it's not as serious either (still bad and embarrassing, but not that serious)

Even with properly hashed passwords etc I'd be worried if my bank allowed login with only a username/password and no further security. I didn't think even that was a thing in 2020.

</comment><comment><USER60> Santander in the UK does this too. You can tell because they only ask for 3 characters out of your password whenever you log in. What's ironic is that whoever did that propably thought they were being super clever.

<comment><USER61> Other banks in UK do that as well, shouldn't they all be reported for this?

<comment><USER37> To whom, and on what basis?

There is nothing in UK law that says banks have to store your passwords "securely".

Issues like this have been raised in the past, and authorities like the ICO have said no law is being broken. GDPR, for example, does not specify technical mechanisms required to store any form of data.

<comment><USER19> See [https://news.ycombinator.com/item?id=22356101](https://news.ycombinator.com/item?id=22356101)

<comment><USER37> Unfortunately, they are still non-committal on what is required. They advise that passwords should be hashed, but there is nothing that makes that a binding requirement.

The gist is still "do what you think is appropriate".

The ICO talks about balancing risks and convenience, and the banks will argue that their systems are secure overall, and don't make the consumer liable anyway.

Under the ICO's guidance, an organisation could argue that plain text (or reversibly encrypted) passwords allow them to do things like password reminders.

You or I might think that's terrible, but they can argue that it's a better user experience.

<comment><USER19> Are you sure? What about the fines they're already giving? [https://news.ycombinator.com/item?id=18531588](https://news.ycombinator.com/item?id=18531588)

<comment><USER37> That's in Germany. It's up to the regulator in each country to enforce the rules.

The ICO has a reputation for being toothless.

</comment></comment></comment></comment></comment></comment></comment><comment><USER62> I once did an API integration with a very popular well known brokerage. When we asked for a test account for their API... well they didn't have a test environment, so they just gave us a real account with 10k dollars in it with instructions to be careful. The test account was something like "apitest11" and the password was like "11apitest". Did that money mysteriously get stolen? Yup! (Not by me definitely, but that account must have been shared with 15 or so people, with a trivial password if it had been an outsider)

</comment><comment><USER63> When I went to TSB (UK) open an account for my partner and she was asked to type her password on their computer she asked when she can change the password, are they any limitations, like wait 3 days before changing password. The assistant responded "why would you ever want to change your password? you can type any password you want now, just please type your password". This was so weird we didnt use the account for a few days, changed the password, waited a few days again and after that deposited money.

<comment><USER64> But you were talking to a clueless bank clerk, not their Chief Infosec Officer, so not really that significant.

</comment></comment><comment><USER65> That's still better than the SSA. Every employer must use SSA to submit W-3 to report employee wages. They only accept case-insensitive passwords up to 8 alpha-numeric characters.

</comment><comment><USER66> A popular bot protection system provided by a third party used by a number of US banks would accidentally disclose plaintext usernames and passwords to the bot protection software.

I'm not sure how the bot protection software was deployed but looking at marketing materials I suspect the data was sent to the third party as part of a SAAS service.

We believe this was accidental because a later version of the software stopped doing it. I'm not sure if there was a notification by the third party to users about this flaw.

</comment><comment><USER67> Same surprise for me when I got back my password from AMEX over phone.

</comment><comment><USER68> The law is not behind or antiquated in this case. Bank cybersecurity has been regulated for quite some time now, and failing to adequately secure your digital assets is a compliance violation no different than failing to catch obvious fraud.

It's very likely that your bank is based and regulated by New York State, even if it isn't physically based there. Contact the NY State attorney general's office, they should take you seriously.

</comment><comment><USER69> There's a similar issue with Wells Fargo. I think it has to do with banks they acquired (in my case Wachovia). My passwords are not case sensitive.

<comment><USER70> Wells Fargo isn't really Wells Fargo. It was a massive bank in the midwest called Norwest (based in MN, but offices all over midwest). Norwest acquired WF primarily for the superior name recognition. The merger with Wachovia happened after that.

for the longest time they you could set your password to be anything, but they only checked the first 8 characters and it wasn't case sensitive. Just chalk it up to shit being written in the 80s.

</comment></comment><comment><USER71> You definitely need to tell somebody that they should be encrypting their passwords using something like Format Preserving Encryption. FPE [https://www.tokenex.com/blog/format-preserving-encryption- an...](https://www.tokenex.com/blog/format-preserving-encryption-and- nist-800-38g-what-you-need-to-know)

</comment><comment><USER72> This is doubly bad because not only is your password in plaintext, it also means that anybody who works for the bank is able to view said password.

Don't get me wrong, plaintext stored in a DB is bad enough, if the DB gets compromised, but apparently they don't even need that as they have an interface that customer service can use to view your password.

How secure do you think that system is?

</comment><comment><USER73> Use a generated unique password for every site, preferably with a password manager. Along with the _absolutely most important_ thing you can possible do for banking security, which is to check your statements/transactions promptly every 30 days. Beyond that it's not really your worry, besides having to possibly attend to helping them clean up any messes.

</comment><comment><USER74> It is possible that this is intended and that they will prompt you to enter a new password on login.

Ask yourself these questions:

Are you sure it was your password? Did they generate a password for you? Did they verify that you are the account owner by asking you to enter the "hotline-pin"?

</comment><comment><USER75> A friend of mine wrote a newsletter on this topic last year - banks are full of anti-patterns!

[https://whyisthisinteresting.substack.com/p/why-is-this- inte...](https://whyisthisinteresting.substack.com/p/why-is-this-interesting- the-security)

</comment><comment><USER76> My bank uses 2FA or biometric via their android app to approve all payments and adding of new beneficiaries on their online banking platform.

But it is a pain when I switch phones and need to get the old one deactivated and the new one authorized.

</comment><comment><USER77> Some people have noted that they might store part of your password, but they could also be using some sort of master key to encrypt their passwords. Meaning they can also decrypt them and provide a UI for their help desk.

Still awful, but not as awful.

<comment><USER78> Hypothetically, if that were the case, it creates a single point of failure for the whole system and is effectively "security by obscurity," imo. A malicious actor with the time, resources, and/or internal connections could obtain said master key and have access to the entire bank's database.

</comment></comment><comment><USER79> You should give them 7 days and tell them you have a responsibility to let the community know what bank it is. You should communicate this clearly to the bank and then let us know.

</comment><comment><USER80> Nearly all of them do unfortunately. They will only change this after getting hit with massive fines from a data breach.

What you should do: Never reuse a password when working with financial institutions older than 5 years old.

</comment><comment><USER81> I got locked out of my account (forgot my password) with said bank and they had no way of telling me my password. Had to wait for them to send me a OTP mailer so that I could login and create a new password.

</comment><comment><USER82> I was going to say vote with your money and leave but then it occurred to me where do you go, is there any public list of banks or institutions that have passed some kind of security audit?

</comment><comment><USER83> They have to no? If you want to link some other bank accounts you have to give them the associated credentials that they pretty much have to store in clear (or encrypted at rest whatever).

</comment><comment><USER84> Just do a Tell HN: Bank of Foogistan stores passwords in plain text.

Don't agonize about it so much it's not like you're going to hurt the banks feelings.

No one will notice or care anyway and banks deserve what they get if they do this.

And if the bank does pay attention they'll just fix it and move on. Don't know why you feel this is such a big deal.

Who would you tell that would even care? I can't imagine the police jumping into their car with sirens screaming. "I wish to report a terrible crime".

</comment><comment><USER85> 1) Inform the bank 2) Inform the FDIC 3) After a reasonable amount of time inform the public

</comment><comment><USER86> (Throwaway for obvious reasons)

Proud of my bank in India (State Bank of India) which is crazy over security. Secure password requirements for login. Another completely different password for managing my banking profile and adding bank transfer beneficiaries. OTP for each money transfer related activities I do from the bank.

</comment><comment><USER87> Was it a password or secret question like "mother's maiden name"?

</comment><comment><USER88> can you tell us the name of this bank so we can avoid business with them ?!

</comment><comment><USER89> perhaps it is encrypted, rather than hashed.

</comment><comment><USER90> Move your money. Support your local/regional banks.

<comment><USER45> Are local/regional banks more likely to have better security practices? I'd think they have worse ones, especially since they don't have the money for cybersecurity consultants which are usually fixed cost.

</comment></comment><comment><USER91> Name and shame

</comment><comment><USER92> name and shame.

</comment><comment><USER93> Of the bank is in Europe also, it's a GDPR breach

<comment><USER94> How? My qwerty123 password isn't information directly connected to my identity.

<comment><USER93> GDPR Password Policy: Critical Components

[https://www.enzoic.com/gdpr-password-policy-critical- compone...](https://www.enzoic.com/gdpr-password-policy-critical-components/)

</comment></comment></comment><comment><USER95> The password is probably encrypted using a two-way hash. It's not as secure as a one-way has, but you can't see passwords by running a SQL query.

<comment><USER96> What is a "two-way hash" and how is it different from normal encryption?

<comment><USER95> [https://cs.stackexchange.com/questions/69422/two-way-hash- fu...](https://cs.stackexchange.com/questions/69422/two-way-hash-functions)

</comment></comment></comment><comment><USER97> If this is really happening this is a serious issue that needs to be fixed ASAP and everyone alerted..

but.. something doesn't look right here..

OP is a throwaway account created today, which I can understand for this type of thing.. but...

they withheld the bank name in the title/desc.. okay again a responsible thing to do.. but...

when asked what the bank name was in the comments they were not shy at naming it..

Something just doesn't feel right. Why the sudden change of heart?

For everyone's sake I hope I'm right, that this is just FUD.. to the OP if you really are serious I'm sorry, and please do report this ASAP.

<comment><AUTHOR> Unfortunately I'm not awake at all hours of the day to respond to internet comments. But if you want further evidence that their passwords are indeed stored in plaintext, consider that their password rule prohibits the special characters !, /, \, <, >, etc. You can verify that yourself.

<comment><USER98> This is weak evidence as these rules could be implemented at the point of new password entry, prior to encryption/storage.

</comment></comment></comment><comment><USER99> Is there actual damage? At the end of day, as a customer,all I care is my money is available (not stolen) and I can access it when I need it. Why should I care about implementation details ?

<comment><USER100> I feel the bank should be liable for stolen funds or information in the case of a security breach.

<comment><USER99> Yes, I expect the bank to protect my money. What I'm saying is how they actually do it, clear text pwd or whatever is not really my concern. Why should I ?

<comment><USER101> You're right, you'll probably get your money back if your password gets stolen.

Eventually. Might be real disruptive if you're in the middle of buying a house.

I'd probably choose my bank to minimize my chances of dealing with a giant bureaucracy for however long (and the non–zero possibility that I actually _won't_ get my money back). But if that's not "damage" to you, feel free to keep doing business with them!

<comment><USER99> >Might be real disruptive if you're in the middle of buying a house.

Agree, I consider this a damage but if the bank can avoid causing me any disturbance despite of using clear text password or <insert any other questionable security practice> then why should I be concerned ?

<comment><USER102> The same reason you might be concerned even if a doctor can deliver a baby safely despite not washing his hands in between a cadaver examination and touching your wife.

Do you feel lucky? Well, do ya?

<comment><USER99> Sure, If the doctor can deliver baby safely and not causing any other damage despite not washing hands then what's the issue?

That's why I asked what is the actual damage. Is the money is stolen ? Is the money can't be accessed ? If the bank doesn't do me any actual damage despite the clear text password then I don't see why I should be concerned.

I guess I can see that for some people, clear text password usage can cause them anxiety and lose some sleep.

<comment><USER102> Are you genuinely saying that when you see someone putting you at risk, that you do not see a problem with it _until_ a problem actually occurs?

Imagine you worked in a building for a week and didn't die in a fire. Would you have a problem with discovering that the writing was done by a amateur, there were piles of lint and fabric everywhere, and there was only one revolving-door exit?

If yes, then you understand the problem of risk and its just a question of magnitude.

If not, then you should be aware that you see the world _dramatically_ differently than most people.

<comment><USER99> The risk are highly exaggerated, the damage may never occurs in the first place.

It may seem unlikely that the bank can keep my money save by using plain text pwd but if they can somehow do that, why do I care.

Even in the unlikely event that the money is stolen but if the bank can handle that without causing me disruption then whats the issue.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER103> Do you really think the only thing the bank does to log people on is to check the username and password? Banks are way more sophisticated than this and it goes well beyond merely string-matching credentials; there's all sorts of other environment, behavioral and heuristic patterns used to establish legitimacy. Even if you rose this issue with the bank, they'll hardly change their modes of operation, and you certainly won't ever see a bank telling you how they do it, but those "hidden security features" make a significant contribution to the bank's security posture; ie: [https://twitter.com/mbna/status/1016270694299127809?s=20](https://twitter.com/mbna/status/1016270694299127809?s=20)

<comment><USER103> In addition to this, you might be interested enough to take note of a number of your banks arbitrary password rules, that one could follow to make similarly negative assumptions. ie; "hey [bank], because my password is limited to 16 characters, does that mean you've got a varchar(16) column somewhere storing plaintext?"</comment></comment>


Ask HN: How do you split work on web apps? - <AUTHOR>

About a year ago at my workplace we decided to get into developing a web app for internal use (as part of a more intricate system which is irrelevant to this question). No one really had experience in web development, so probably some of our decisions were wrong, but all in all we've had success with the tool we were developing. Since we did have experience developing in Python, we chose Django as our platform.
My question is about "who does what". The way we split our work was: there is one team which handles all the Python code - which means all the Django urls, views and models, as well as the actual backend to handle asynchronous task execution (something a bit like Celery). A different team (more precisely, a single person in a different development group - but this is just implementation) is responsible for the templates (data binding), javascript, design, HTML, CSS, etc.
We have been working like this, as I said, for about a year now. I'm starting to think that maybe the line of responsibilities between the two teams is wrong. The reason is that there's a pretty big overhead whenever we need to interact - which is a lot. For example, when we add a new table and we want to display it, we need to let the "frontend guy" know what the url would be and what it would contain. Then we need to integrate out work to see if everything's alright. Sometimes we didn't pass enough context to the template to make it work and there's a slow ping-pong of information between us.
So my question is this - what is the accustomed way to split work on web apps? Who takes care of the different modules - models, views, urls, templates, design, user experience, HTML, CSS, javascript? I'd love to know how YOU do it. <comment><USER2> I'm not sure if this is helpful, but as a full stack-developer, I still work in a similar structure to the way you've described.

Essentially you're talking about two sides of development. Front-end vs. Back- end, and yes, it is very common to split up work like that. I've never heard anybody describe 'modules' as 'models','views','urls', etc. etc. though.

A back-end dev, team, or when doing back-end work, you're focused on the server side architecture and code. That would include your models, views, controllers, routes, database, etc.

A front-end dev can then take these end-points (routes or URLS) and build the templates, and front-end experience (HTML, CSS, Javascript).

I think the problem you may be having is in how you're defining what you're working on. You say specifically 'when we add a new table', but a front-end guy isn't going to know what to do with a 'table'. That is back-end. Both teams should be focusing on the feature or capability you are providing, not the technical structure. So rather than saying to the front-end guy 'we added a table and need a view into that table', you may have more success saying 'we want to show how weather patterns affect our shipping rates' or whatever it is the table does. Then the front-end guy can take your URL and from a user- perspective build a solution which solves the problem.

Another thing to consider is that design and user experience is not part of Front-end development. You may have a front-end dev who is good at UX and design, but if so, you'll be very fortunate. Some Front-end devs can do design, but not all. So you may want to make sure that before the Front-end (or even Back-end) guys get coding, they have the design of what they are building. That may help both sides come to the best solution quickest.

</comment><comment><USER3> Diving into frontend vs. backend is very common and in my experience, a successful strategy. But within reason. To use your example, your backend developers should be able to code an HTML table.</comment>


The Forgotten Home of Tennis's Open Era - <AUTHOR> https://www.nytimes.com/2018/04/22/sports/tennis/british-hard-court-championships.html <comment><USER2> It's strange to think of an era where the prestigious competitions were in amateur sports and this watershed moment was allowing professionals (who made their money playing in smaller tournaments) to compete. My understanding is that this was a class issue, where ladies and gentlemen who did not need to work for a living did not rub shoulders with the people who did.

<comment><USER3> In Dutch chess, grandmaster JH Donner was the first professional player. In the 1960s he played in the Dutch team.

The other team members got paid for playing in tournaments because they had to take time off from their jobs and obviously had to be compensated for that, but Donner got paid nothing because as a chess professional he didn't have a job.

</comment></comment><comment><AUTHOR> How odd to find an article in the NYT about my home town.

</comment><comment><USER4> How does this belong on Hacker News?

<comment><USER5> Human org dynamics are always interesting, because they can be applied to many other fields. Consider, "Xerox, the forgotten home of OS's GUI era".

How an org can pioneer a multi-billion business such as modern tennis and still become forgotten, unknown and semi-dilapidated is an insightful lesson IMHO.</comment></comment>