6 ms·

Same thing happened to me, my local credit union emailed me my password. They ensured me that they use "bank-level encryption". Of course I didn't get into the

Same thing happened to me, my local credit union emailed me my password. They ensured me that they use "bank-level encryption". Of course I didn't get into the difference between one- and two-way encryption with the teller, or that email isn't secure. We live in an age where this should be unacceptable. Why aren't there financial security laws yet?

deleted 11y ago
[deleted]
CydeWeys 11y ago
It's so infuriating because I've worked at companies doing digital commerce before, and PCI compliance and certification is quite onerous. But at the end of the day credit card numbers still aren't as sensitive as bank logins, yet there are no security standards on bank logins! It's crazy.
- scruple 11y ago
  PCI compliance is pretty interesting. It's been many years since I worked in an e-commerce shop but I seem to remember that it even described physical security layers i.e., dictating the placement of door hinges to server rooms.
  - rtpg 11y ago
    Goes to show that when money is at stake for the stakeholders then things get done. I don't think banks actually care about individual user login security too much. Credit Cards reallllly suffer from security breaches though
    - JadeNB 11y ago
      > I don't think banks actually care about individual user login security too much. Credit Cards reallllly suffer from security breaches though But the only reason that banks care so much about credit-card security breaches is that the law forces them to do so. If the law didn't make credit card fraud the bank's responsibility, then they'd be just as lackluster about preventing it as they currently are about securing login credentials.
      - lostmypassword2 11y ago
        What law are you talking about? PCI-DSS is required by the card companies and run an organization called the "Payment Card Industry Security Standards Council". It's self-governed essentially. It's not federal law
        JadeNB 11y ago
        I had always assumed that it was a matter of law, rather than self governance. I stand corrected.
      - Domenic_S 11y ago
        I don't know if that's true. Say we lived in a world where those regulations didn't exist and the fraud risk was on par with what it is today. If one bank introduced their own fraud protection program, wouldn't they basically capture 90% of the market overnight?
        JadeNB 11y ago
        This is a good argument, but I'm not sure that I buy this. There are plenty of industries (I think of the cable and cell-phone industries, but I'm sure there are others) where it's just a given that the service will be crappy, even though one company that started to respect its customers could seemingly corner the market. (I'm not sure what are the results of T-Mobile's exercises in respecting its customers. Their unfortunate net-neutrality stance with Binge On means that it's not an unalloyed win to go with them.)
        Domenic_S 11y ago
        I get what you're saying, but credit cards are unique: the advantage credit card companies have over those other industries is that there is essentially no lock-in, and your old cards continue to work while you're in the process of switching eg your autopays over. It's a very switch-friendly industry. Remember when you couldn't take your cell phone number with you and so pretty much nobody switched carriers? It was a massive pain. Now it's easier than ever to switch, except most people are locked into multi-year contracts. Switching friction = high, but not impossible. As you said, TMO is trying to compete here. Cable has monopolies on towns, so there's 0 incentive. People couldn't switch even if they wanted to. I suppose there's satellite, but you'll still be paying the cable company for internet -- they get their pound of flesh no matter what. Switching friction = impossible.
deleted 11y ago
[deleted]
tokenizerrr 11y ago
Well, there's your problem. When dealing with passwords you don't want encryption. You want hashing.
- darkstar999 11y ago
  Hashing is considered one-way encryption, no?
  - sarciszewski 11y ago
    No, it's one-way cryptography, but it's not a form of encryption. https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-password-cryptography-decoded https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass...
collinmanderson 11y ago
I hear credit unions are not regulated as well as banks, so even if there are laws for banks, the credit unions don't necessarily have to comply. Credit union security will probably always lag behind banks. :(
- ArtDev 11y ago
  I don't think that is true. Source? Furthermore, credit unions can't make risky bets that could put them under. The money you deposit goes out as loans to other people. I avoid banks like the plague. Too shady for me, never again.

deleted 11y ago

[deleted]

CydeWeys 11y ago

It's so infuriating because I've worked at companies doing digital commerce before, and PCI compliance and certification is quite onerous. But at the end of the day credit card numbers still aren't as sensitive as bank logins, yet there are no security standards on bank logins! It's crazy.

scruple 11y ago
PCI compliance is pretty interesting. It's been many years since I worked in an e-commerce shop but I seem to remember that it even described physical security layers i.e., dictating the placement of door hinges to server rooms.
- rtpg 11y ago
  Goes to show that when money is at stake for the stakeholders then things get done. I don't think banks actually care about individual user login security too much. Credit Cards reallllly suffer from security breaches though
  - JadeNB 11y ago
    > I don't think banks actually care about individual user login security too much. Credit Cards reallllly suffer from security breaches though But the only reason that banks care so much about credit-card security breaches is that the law forces them to do so. If the law didn't make credit card fraud the bank's responsibility, then they'd be just as lackluster about preventing it as they currently are about securing login credentials.
    - lostmypassword2 11y ago
      What law are you talking about? PCI-DSS is required by the card companies and run an organization called the "Payment Card Industry Security Standards Council". It's self-governed essentially. It's not federal law
      - JadeNB 11y ago
        I had always assumed that it was a matter of law, rather than self governance. I stand corrected.
    - Domenic_S 11y ago
      I don't know if that's true. Say we lived in a world where those regulations didn't exist and the fraud risk was on par with what it is today. If one bank introduced their own fraud protection program, wouldn't they basically capture 90% of the market overnight?
      - JadeNB 11y ago
        This is a good argument, but I'm not sure that I buy this. There are plenty of industries (I think of the cable and cell-phone industries, but I'm sure there are others) where it's just a given that the service will be crappy, even though one company that started to respect its customers could seemingly corner the market. (I'm not sure what are the results of T-Mobile's exercises in respecting its customers. Their unfortunate net-neutrality stance with Binge On means that it's not an unalloyed win to go with them.)
        Domenic_S 11y ago
        I get what you're saying, but credit cards are unique: the advantage credit card companies have over those other industries is that there is essentially no lock-in, and your old cards continue to work while you're in the process of switching eg your autopays over. It's a very switch-friendly industry. Remember when you couldn't take your cell phone number with you and so pretty much nobody switched carriers? It was a massive pain. Now it's easier than ever to switch, except most people are locked into multi-year contracts. Switching friction = high, but not impossible. As you said, TMO is trying to compete here. Cable has monopolies on towns, so there's 0 incentive. People couldn't switch even if they wanted to. I suppose there's satellite, but you'll still be paying the cable company for internet -- they get their pound of flesh no matter what. Switching friction = impossible.

deleted 11y ago

[deleted]

tokenizerrr 11y ago

Well, there's your problem. When dealing with passwords you don't want encryption. You want hashing.

darkstar999 11y ago
Hashing is considered one-way encryption, no?
- sarciszewski 11y ago
  No, it's one-way cryptography, but it's not a form of encryption. https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-password-cryptography-decoded https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass...

collinmanderson 11y ago

I hear credit unions are not regulated as well as banks, so even if there are laws for banks, the credit unions don't necessarily have to comply. Credit union security will probably always lag behind banks. :(

ArtDev 11y ago
I don't think that is true. Source? Furthermore, credit unions can't make risky bets that could put them under. The money you deposit goes out as loans to other people. I avoid banks like the plague. Too shady for me, never again.