Hacker News Reader

Comment by cocoflunchy | Hacker News Reader

Meanwhile 90% of the banks in France use a 6-digit password that you can't paste because you have to enter it by clicking on a super-secure-random grid... https://imgur.com/a/q91JDXi

Maybe Troy Hunt can publicly shame them into more secure practises but I'm not hopeful.

View on HN

My bank's (Lloyds TSB) idea of extra security beyond a password is ... yet another password, but one that you have to select 3 random digits of, in dropdown boxes.

I asked them for TOTP 2FA, but never got a response...

Why is it always banks who have some of the worst security posture out there? I fully expect my bank to eventually implement 2FA ... by SMS! Thinking that it's a good idea!

sigh

A common work around is to make them all the same: that way you don't have to think which ones to type.

It's secure. It defeats keyloggers and it prevents the password from being remembered by the browser and enumerated.

It's usually a PIN that is set by the bank rather than the user, to prevent people from using 123456 or their date of birth.

It only defeats keyloggers that don't record the mouse.

Recording the mouse doesn't allow to extract the password. You need to record the display too.

For the 2 banks that I use, it is set by the user. And for BNP you have to change it every 80 uses, so you end up using something really easy to try to remember it...

that actually is secure ... if you have a secure display

In the same sense that a password manager is secure if you have a secure keyboard.

Reply on news.ycombinator.com