5 ms·
The security of my bank is pretty good, any account management action (password reset, card pin change, mailing address, email, name, etc.) requires physical pr
by zaarn 9y ago
The security of my bank is pretty good, any account management action (password reset, card pin change, mailing address, email, name, etc.) requires physical presence in the closest branch. Not any arbitrary branch, the closest. With my passport. Not some bill or mail on my address. My passport.
The password reset will then setup a new password with 12 characters, number and specials included. This password is then sent via german postal service to my house, I can't pick it up on my local branch or have it told to me. Send via mail. Period.
The letter advices me to change the password to something secure immediately and destroy the letter securely afterwards. The banking website enforces this and you cannot change your password to any temporary password that your account previously had. (So if someone intercepted the letter, you would either notice or it would be useless)
The only downside is they have an ancient COBOL mainframe doing the accounts, so they're case insensitive and encoded in ECBDIC, although they are properly hashed using bcrypt, there is an upper limit of 24 characters because it still passes through there.
So I would say my bank is banking on the customer picking a good enough password and hoping they can replace the COBOL mainframe at some point.
- tolle 9y agoThey could just swap out the authentication mechanism instead of the entire COBOL stack. I don't really know why you wouldn't just run the auth bits in some other language. The programs that calculate your monthly interest on your mortgage doesn't exactly have to have to be able to handle your login credentials.
- zaarn 9y agoAFAIK it's because their entire system is rather legacy, so over the years they tacked on fixes while "the replacement will be done soon(TM)". Banks do have some problem with these sorts of projects, so I think they're trying to build something that will last as long as the COBOL system at less cost.
- mikeash 9y agoRequiring a physical presence at a single branch doesn’t sound like good security to me. It does sound effective at preventing unauthorized access, but good security must also be good about allowing authorized access. Otherwise, the best bank security would involve encasing your money in concrete and sinking it to the bottom of the ocean.
- zaarn 9y agoIt's not a very long date, you show up, show passport/id-card and they'll authorize you getting a new password send. And while you're there you can write out any SEPA transactions you need done onto paper and submit manually (almost any bank still has a special mailbox for manual submission).