Scumbag Bank's Two-Factor Authentication: Strong Rules, No Hashing
Description
A meme using the 'Scumbag Steve' format, but replacing the person with a classical-style bank building. The building, featuring columns and a pediment with the word 'BANK', is wearing the iconic brown checkered scumbag hat tilted on its roof. The image has two captions in bold white text with a black outline. The top text reads: 'ASKS YOU TO PICK A NEW PASSWORD TWICE A YEAR WITH AT LEAST 1 DIGIT AND 1 SPECIAL CHARACTER'. The bottom text reads: 'STORES PASSWORDS IN PLAINTEXT'. The meme satirizes the hypocrisy of institutions that enforce strict, often inconvenient, user-facing security policies while neglecting fundamental backend security practices. For developers, the joke is painfully familiar: witnessing security theater that burdens users but fails to implement basic measures like salting and hashing passwords, leaving them vulnerable in a data breach
Comments
10Comment deleted
Their password policy is just security theater. The frontend demands a password worthy of Fort Knox, while the backend stores it in a .txt file named 'DefinitelyNotPasswords.txt'
Six hours arguing over NIST 800-63 password entropy, zero minutes to notice the dev wrote `logger.info("user={} pass={}")` - but hey, it’s “inside the firewall.”
The real vulnerability isn't the password complexity requirements - it's the senior architect who insists their 20-year-old custom 'encryption' function that just Base64 encodes passwords is 'military grade' because it survived three acquisitions and two SOC2 audits
Ah yes, the classic enterprise security paradox: mandate password rotation every 90 days with uppercase, lowercase, numbers, special characters, hieroglyphics, and a blood sacrifice - then store it all in a VARCHAR(255) column. Because nothing says 'we take security seriously' quite like enforcing NIST-deprecated policies while violating OWASP Top 10. At least when the inevitable breach happens, the attackers won't have to waste GPU cycles on rainbow tables. It's almost considerate, really - like leaving the vault door open to save them the trouble of cracking it
Enterprise security: biannual rotation and a regex, backed by a VARCHAR(255) password column with no salt or hash
Mandate 12+ chars and 180-day rotation, then store it in users.password VARCHAR(255) - congratulations, you just shipped Security Theater as a Service
Enforcing NIST SP 800-63B minus the hashed storage clause: peak enterprise security theater
Shitty sberbank be like Comment deleted
and a max limit of 8 characters and no you cant copy and paste it from your password manager we disabled that with javascript for security Comment deleted
And we provide our own in app ABC keyboard Comment deleted