Hacker News Reader

Comment by lytfyre | Hacker News Reader

My bank requires 8 to 10 characters, [a-z]|[A-Z]|[0-9] only. They also require you to know something easily researched from facebook (elementary school, mother's maiden name, etc.) when you use a new machine.

That they refer to this as two factor authentication makes me question their ability to do simple addition, something I consider a fairly important skill for a bank.

View on HN

That was another point I meant to raise. Even if your password policy and weak-password checks are sane, if your account recovery procedure is weak, there are still planet-sized holes in your security perimeter.

And for any large system (say, Facebook, with, oh, nearly a billion accounts), user support requests (many of which are access related) are a huge cost. It doesn't take many of these to eat through $2-$5/account/year value they're seeing.

Not that it excuses this so-called security, but for the insecurity question, you could just lie. Only problem is, then you have to remember your lies.

> They also require you to know something easily researched from facebook (elementary school, mother's maiden name, etc.)

I'll never understand why someone would provide this information to Facebook. My friends already know the details of my life relevant to our relationship.

maybe because they're part of a "$foo High School class of '99" group/page/whatever with some friends, or perhaps both parents and grandparents are linked as friends, making it pretty easy to figure out mother's pre-marriage surname?

It's not just the explicit facts you provide, a significant part of the deeper value is from the linkages between them.

something I consider a fairly important skill for a bank

but not important enough to switch apparently

You're assuming the others available to him are any better.

Reply on news.ycombinator.com