Hacker News Reader

Comment by pitaa | Hacker News Reader

What is it with banks and their annoyingly terrible "security" requirements? My old bank once sent me an email saying I had to reset my password. The email seemed legit, but upon following the link therein something didn't seem quite right. So I use another device to visit my bank's site directly. Upon trying to login, I get redirected to the same form I reached from the email link and had a sinking realization that my bank did indeed expect me to fill in my name, address, SSN, DOB, debit card number, and PIN just to reset my password.

I sent a strongly worded email to a handful of people at the bank asking them if they really thought it was a good idea to teach their customers that its okay to click a link in an email claiming to be from their bank and provide that much personal information. I never got more than a canned response back, but several months later they did overhaul their password reset procedure to a more typical one.

View on HN

One time I found I couldn't log in to my bank account online. Called them up.

"Oh, we changed your username as a security measure."

Oh.

Wait, username??

Typically management at financial institutions see "security reasons" as a quick way to end questioning from a customer.

Legacy software or partner integration requirements are almost always the reason for arbitrary changes within financial institution.

Anecdotally, I've never seen a scenario myself where this wasn't referred to as a "security measure" or similar. This includes within the institution to all non-technical employees.

They had good reasons to enact security measures as I was trying to get into my account internationally and I kept forgetting the password. I understand what you're saying though.

Makes me wonder if they didn't have any other way to disable logging in to the account. Which is worrying in a whole other way.

I suspect it's the same reasons nuclear launch facilities use floppy disks -- the solution is approved, and getting a new solution approved is viewed as too expensive/infeasible.

Not saying the argument is valid, just that it may be the reason.

That and its proven to work, has a ridiculously long track use history (for software) so the bugs are fixed or well documented, and pretty damn hard to exploit. It's not like anyone is going to plug an 8 inch floppy disk they found laying in the rural Wyoming dirt parking lot into the nuclear silo master computer to check what's on it.

Yikes! Last time I looked, the intercontinental nuclear launch codes of any major power have not yet been proved to work.

But OK, I assume they still pass whatever dry-run test procedures exist. But if it is true that they are based on floppy-disks, then I don't think sticking with them is a net win for reliability and safety.

Bits rot, especially on floppies. So if they are still using them they have created procedures for refreshing the bits from backups. By now the floppies might be little more than ceremonial objects inside the systems that really determine the launch procedure.

And those systems would have evolved informally over time and might be ever-changing, poorly understood and poorly tested.

On the other hand, when the collective idiocity better known as the Internet of Things finally comes back to bite us in the ass, we can at least be sure it wont be in the form of a nuclear winter.

I'm having a battle with HSBC in the UK at the moment and can't get past canned customer support responses either.

If there is a security issue with your card, HSBC Fraud department will send you a text, telling you to call them.

The text comes from an unknown number. The number you are told to call is not listed on their website anywhere.

At the same time they are sending letters to customers warning about how to protect from phishing attacks.

I've been trying to explain to them, that they are training their customers to accept phishing attacks, but they are having none of it.

Yes, I understand that they don't want to publicise their special number on the website - but at least put it on an unlinked page, so that if a customer visits hsbc.com and searches for the number it comes up in the results.

I really don't understand these people.

I've known banks that don't let you change the PIN on their cards - for "security" reasons. And banks with 5-digit maximum password lengths - "oh, it's strong enough, you need to use a token to get money out anyway" ... but not to login.

Many banks in Saudi Arabia have changed their standard for PIN length from 6 digits to 4 digits. I cannot comprehend why would anyone make such decision.

Many international withdrawals only do 4 digits which means 6 digits in your home country becomes meaningless...

they should fix the underlying problem but in the meantime, they probably could just automatically truncate to 4 chars when 6 can't be used?

No, because certain combinations, e.g. 1111 are prohibited in four digit codes but wouldn't be at the start of six digit codes.

The IT community should launch a campaign against the stupidity of banks' security procedures, which discredit our jobs...

I think it's OK to have short passwords if you block access after a few wrong login attempts. The password reset Form you've described is ridiculous, though.

Your anecdote describes a very bad behaviour, but the generally simple requirements banks have is a necessity of dealing with the general public. The more complex the requirements, the more customer support with tech naifs you need. And overall, it generally kind've works for them; there are some slips through the cracks, but fraud isn't rampant - banks accounts have been successfully run this way for years for the vast majority. Make it harder for people to get their money and you've created a significant friction point that will see your less tech-savvy clients almost literally flee to other banks.

The problem with this is that if that if there is a breach your typical bank will not take responsibility and claim that the customer is liable.

It needs to be written into law in all jurisdictions, that if a bank has been negligent in security, then when responsibility for a breach is unclear the benefit of the doubt should be given to the customer and the breach classified as a bank robbery.

Talking about bank, when i tried changing my transaction password my bank sent me an acknowledgment letter which had to be submitted physically to the bank again with all the details filled onto the form then you have to wait in the queue to get signatures and approval. All being said the worst part was that the letter took more than 2 weeks to arrive at my home and the letter had transaction password which you have to change again.

My bank requires a number in the password and in the username, but doesn't seem to do any validation that the two inputs contain different numbers before storing them.

I imagine a lot of customers are using the same number in each.

Reply on news.ycombinator.com