Every financial institution I have interacted with has failed to store hashed passwords. So I looked up the reason why. Turns out that the Payment Card Industry Security Standards Council Data Security Standard (PCI DSS[1]) stipulates only that passwords and other sensitive are to be stored with encryption, and also transmitted as such†—but only amongst other financial institutions‡. So while they can’t keep your password in cleartext, they are free to send it by email, text message, or town crier.
> Render all passwords unreadable during transmission and storage on all system components using strong cryptography.
‡Introduction and PCI Data Security Standard Overview:
> PCI DSS applies to all entities involved in payment card processing–including merchants, processors,
acquirers, issuers, and service providers, as well as all other entities that store, process or transmit cardholder data.
>> Render all passwords unreadable during transmission and storage on all system components using strong cryptography.
>(It appears this does not include cardholders.)
Ah, very informative. So, here is the problem: the fact that crypto is specified when it's the wrong tool for this particular job (that of storing my online banking password). I don't want my password encrypted. I wanted hashed and salted with something like bcrypt, and I don't want it sent in the clear over email.
[1]: https://www.pcisecuritystandards.org/documents/pci_dss_v2.pd...
†Requirement 8 (part 4):
> Render all passwords unreadable during transmission and storage on all system components using strong cryptography.
‡Introduction and PCI Data Security Standard Overview:
> PCI DSS applies to all entities involved in payment card processing–including merchants, processors, acquirers, issuers, and service providers, as well as all other entities that store, process or transmit cardholder data.
(It appears this does not include cardholders.)