How could online banking stop sucking
micho.biz
micho.biz
1. Log in from the home page: This would require the bank to serve its home page from https, including a redirect from http for every visitor, in case he or she wants to log in.
2. 4-digit passcodes: You're missing the key point about your ATM login -- it's only secure because it combines something you have (your ATM card) with something you know (your PIN). If everyone's login is a 4-digit number, then if I have a list of 10,000 users of your system, it would be trivial for me to compromise at least one account (not of my choosing) without even resorting to multiple login attempts.
3. Setting all login ID's to users' email addresses: This just removes more entropy from the login security process, since I now know that logins come from the set of valid email addresses. For any individual user, I now know their login with a high degree of certainty.
4. API: Do you think that banks really want to circumvent their security measures by allowing third parties to hold keys to the front door, even if the proverbial vault is locked?
All that said, I do agree that there are things that could be improved: making the login button front-and-center, so I don't have to guess where to find it; giving better choices for exporting financial data. But, you've got to realize that banks (online and offline) are prime targets for criminals, and that in some ways user experience has to take a back seat to protecting assets.
And that's a bad idea why exactly?...
> Setting all login ID's to users' email addresses: This just removes more entropy from the login security process, since I now know that logins come from the set of valid email addresses.
Currently the username in my bank is a 9-digit number and they've got "over 30 million customers" I'm pretty sure I can guess a valid username in under 10 tries ;) Meanwhile, emails are almost an unlimited search space. The only thing that changes is that you're more likely to know who does the email belong to.
Most banks already offer an API, in the form of OFX. The security measures (like challenge questions) are already circumvented, and I've seen some really bad security flaws in OFX implementations when I last played around. e.g., inter-customer money transfers without requiring anything but the password, no auth lockout making brute-forcing possible, ability to crash the OFX gateway, &c.
(Yes, the newer OFX standards support multi-factor authentication, but I don't know of a single bank that uses the newer version.)
Also, most FIs hate the idea of financial aggregation, being worried about other companies cross-selling to their customers.
A sane REST API would be a wonderful step in the right direction, but I doubt it'll happen in the next ten years on a large-scale. Getting OFX to where it stands now took the combined market forces of Intuit and Microsoft many years, and didn't turn out well.
3. You might get some tiny fraction of additional security (through obscurity) by obfuscating people's logins, but this is ridiculous, unnecessary, and at great expense to the user experience when a decent password provides all the security you need.
Yes, email providers allow you to log in from their front page, but even then only from their gateway page. As a good example, www.yahoo.com does NOT have a login for their webmail client -- you have to click through to a separate screen. You only see the login if you go directly to mail.yahoo.com.
The idea of a weak password so you can have more easily a nose around someone else's private details is frankly laughable. This is personal financial information, not Facebook, FFS.
A moment's reflection, and you can imagine the headlines.
Banks often have you confirm recent transactions on your account to verify your identity (over the phone, for example), making this data pretty sensitive. But even setting that aside, I think most people would like their balances and transaction histories to be pretty private. It only seems reasonable to me.
Something completely different is securing sending out money
It's not sufficient to let the user decide how much security they should have. It won't protect the banks from the expectations of security placed on them by others, however unreasonable that might seem.
Also, stop restricting the data I can download to the most recent 30-90 days.
Paypal and Amazon both let me download my entire purchase history (>5 years for both) with a ton more detail than the bank.
If security is an issue give me a client SSL cert and force me to do 2 factor login (SSL cert + password) to grab a feed of data. This isn't rocket science - it's me wanting a simple "select * from checkingaccount" from your database on the other end of a HTTP request.
Crucially, I must generate a different one-time password using a different procedure if I wish to transfer money to someone I haven't previously paid. This essentially puts paid to phishing and man-in-the-middle, as an authenticated session isn't enough to do anything malicious; To steal my money, you would have to either completely break the cryptosystem, or convince me to enter your account number into my card reader to generate the necessary one-time password.
[1] http://www.barclays.co.uk/Helpsupport/IntroducingPINsentryfo...
Account access requires a keypad widget, an account number, the widget's serial number, a pin and the generated one-time pass.
Any transactions require a second one-time pass derived from a different algo.
My provider (ABN Amro in Holland) works like this:
1. Login is your account number and card number (1234567 + 004, located on card)
2. Password is generated by putting your 'smart' card into a little device, typing a PIN in, and typing in the resulting one-time pass. Other banks do this by sending the code via SMS, which is also good (though a bit less secure).
3. Interface is not mind-blowingly web 2.0, but works pretty well.
4. Transfers to other bank accounts are free, happen within one business day, and are confirmed by performing step 2 for each batch of transfers.
5. There is an iPhone app, which you do a one-time authorization with step 2, and create a 6 digit pin code. This code let's you check your balance. Performing transactions requires step 2 again, unless you are transferring to someone in your address book (there is a limit which you can set).
To be honest, it's pretty good. It's first priority is clearly security, and given that it's pretty damn usable.
US banks should take note.
So it's secure, works in all browsers, and gives you choice in how you want to log on. And on top of that, the actual service is great, paying bills is easy and free, opening accounts and moving money between accounts is instant and free, transferring to other banks or other people is free (but takes time), automatic bill payment is easy and free.
And the other banks in my country aren't bad either, competition forces all of them to be secure, free to use, and easy to use.
1) I had a check stolen. The thief was able to write themselves (or someone they know) a check for $100, sign it with my name, and deposit or cash it. I only discovered this after seeing the transaction in my history and notifying the bank. The forged signature was looked completely different from my own. What's the point of a signature if it's not used for authentication?
2) Because of the above, during the fraud claim process I had to close my account. This disrupted my direct deposit and my employer attempted to deposit my paycheck into a closed account. I didn't realize this until the payment was being returned. I was told that I would have to wait 5 business days for the payment to be resolved. Why isn't this instantaneous? Why do high frequency firms enjoy millisecond trading while consumers have to wait what is basically the equivalent of postal mail delays for electronic transactions? I'm sure this is vastly simplified (HFT firms colocate with exchanges, consumer banks must have to comply with regulations that necessitate these delays) but it does seem that the ordinary consumer is being screwed out of some innovation here.
3) Finally, just this past week, someone accidentally deposited over $1000 into my account. They must have made a mistake with the account number. I told the bank about it, and it still hasn't been resolved. How is this even possible? From what I understand, all you need to withdraw and deposit money from an account is the combination of routing number and account number, and this seems so crazy in the way it opens up for mistakes or abuse.
Of course, I'm likely underestimating the complexities and histories here so I would be very happy to have my naivete corrected.
1. 12 digit pin / complex password
2. Physical reference card (like a puzzle game to answer on login)
3. Must reply to SMS to transfer funds / configure payments
"What’s worse, a weak password, or a password that sits on your desk?"
Contrary to what is said in the article, a weak password is worse - no question. A password that sits on my desk is only available to people who break into my home. If they do that, they probably have access to other documents of some importance.
A password that is weak can allow anyone access to my account, from anywhere.
Bank password polices are retarded. I currently have one that requires 6 characters. No more, no less. This may be the worst offense I've seen but it doesn't excuse the other bullshit that passes as secure or acceptable in the banking arena. These guys need help.
"Allow weaker passwords and limit login attempts" is not the solution either, because it gives an attacker who has discovered my user id but not my password the ability to lock my account.
- don't have silly password restrictions (login is username + password 1 + 3* n'th letter from password 2, transfers need password 1 again, large transfers to unknown destination needs phone confirmation (automatic service))
- have website working well in pretty much any browser
- provide instant SMS notification about low balance and an account summary every week
- have pretty low waiting times (whenever I call, it's rarely more than a minute before my call is picked up)
- process my statement and split known records into groups showing me money spent/earned from various sources (car, house, food expenses, etc.); they find recurring payments and put them into a calendar which gives a good idea of how much money I need and when; effectively they killed the need of using local app for keeping track of my account
- they provide exports into csv and other formats (although they've got a "known issue" for years where the export range is approximate - it can add or miss a couple of days randomly)
- they do watch my account - when my employer missed the payday by 1 day, I got a call to check if that's expected; when I got a larger incoming transfer, I also got a call to notify me about it and check if it's expected (did not request that before)
I do recommend them to other people, because they're better than other banks I had to deal with.
It's considerably faster than trying to use their web site.
Two of the banks I use share the same web engine. They've both bought it from some company that I don't know. Both banks are of the smaller ones so they don't do internal development, hence outsourcing: big banks would probably exhibit a loud NIH syndrome.
Now, one of the banks I use has had it for at least over ten years, having been a customer there, and the user interface hasn't essentially changed much. I remember a couple of cosmetic updates but the pages still look pretty minimal and clean. This is a sign of caring about users because web user interfaces tend to get replaced every few years for the sake of getting renewed. Somebody has clearly had an opinion on how an online banking interface should work, and that somebody has stuck to it. For years.
The login, as is typical in Finland, is a username + password, plus a ever-changing PIN code from a printed table. You need one PIN code for login and another if you issue wire transfers. I've had the same username since 90's and I've changed the password maybe twice. I don't have them on paper. I get a new PIN code table by mail a couple of times a year as soon as the old one is about to run out of codes. Pretty secure and convenient: set of credentials that don't change and another set of simpler credentials that change every time.
Too bad their demo logins are in Finnish and Swedish only, not English. From what I read, this company has awaiting sales in the U.S. :)
Also in my bank the password need to be shorter than 15 characters, I will never understand this.
https://simple.com/ is the way to go.