3 ms·
The takeaway is that if your site handles highly sensitive data like financial or medical records and you allow users to login with just an email and a password
by MarkMc 8y ago
The takeaway is that if your site handles highly sensitive data like financial or medical records and you allow users to login with just an email and a password, you are doing it wrong.
Almost no bank website allows login with just email/password - there's always some extra field required such as a User ID with random characters, an account number, a PIN number or a code from a second device. The reason is simple: if the bank accepted just email/password there would be a lot more fraud and the bank would lose money.
- tatersolid 8y agoAll six of the (major) banks I use require username and password only. And four of those limit password length to less than 12 characters.
- MarkMc 8y agoI should have said 'extra information', not 'extra field'. A username with random characters like C85Y922 is clearly more secure than an email username. Of the 6 major banks you use how many have email address as the username?
- tatersolid 8y agoSome require a separate username crafted by the bank, but they are low entropy. Something like last name plus 2 digits. One is a clearly sequential integer of limited range. Usernames are not secrets and add no security by being kept secret. Just lengthen the damn password instead!