5 ms·

I sure wish my brokerage would allow me to turn off all online password reset options. They have an office near to me. If I forget my password, I would like to

I sure wish my brokerage would allow me to turn off all online password reset options. They have an office near to me. If I forget my password, I would like to have to go to the office with my passport to reset it. This person should be high level and well trained so that social engineering is unlikely to work on them. I would be happy to do this and would prefer if they charged me $100 to reset my password this way. I don't day trade so I don't need a way to instantly reset my password. Many years ago I reset my brokerage password online and it was way to easy to do. The amount of money I have in the account is small enough that I have not seriously looked into other options yet. How do people with $5 million in a retirement account deal with the fact that someone could really screw you over by getting into the account? It might be somewhat difficult to get money out of the account, but if you are just trying to hurt someone, that should not be too hard. Log in. Use a million dollars to buy a bunch of a penny stock and the price will skyrocket as you buy. Then start to sell and keep selling as the price plummets.

rhacker 8y ago
I've actually wondered the opposite. If someone is charming enough, and has done some preliminary research on the bank's in-person screening, could they bypass security with something as little as a fake ID? Overall, I don't know if there is a perfect solution. Perhaps for banks we should pee-in-a-cup DNA test in addition to other tests. For a porn site we can do a poor mans email reset.
- _dark_matter_ 8y ago
  I believe that DNA tests fail the same reason that eye scanners and fingerprints do: they are not private. Almost anyone can get access to any of those 3, and then they just need to figure out a way to use it on the system.
  - tedunangst 8y ago
    Is it really that easy to forge someone else's DNA and bring it to a testing facility?
    - tialaramex 8y ago
      DNA is a replicator molecule. You don't need to forge it, just get a tiny sample and it will make as much as you could ever need with gear found in any high school lab.
  - rhacker 8y ago
    The bank manager needs to watch you pee. jk
- njarboe 8y ago
  "If I forget my password, I would like to have to go to the office with my passport to reset it. This person should be high level and well trained so that social engineering is unlikely to work on them." Passport and well trained. If it was clearly a premium option that you paid good money for, the bank or brokerage could have a smart, well trained person handle this. Charge me more than $100, if that what it takes. I think if you eliminate people that don't live in your legal jurisdiction from defrauding you and make them show up somewhere in person (Russian hacker, Nigerian scams) the likelihood of the fraud happening goes down by 3-4 orders of magnitude.
  - patio11 8y ago
    This is an option at many financial institutions and often required above a certain level of transaction, but retail customers don't hear about it quite so often because it's in the general category of "If you have to ask, you can't afford it." The magic word is Medallion Signature Guarantee and the mechanism is, basically, "Bank of America is satisfied that we were talking to Bob when we affixed this medallion on this paper and if we were wrong we're good for $500k." The most likely place one is likely to run into this (assuming a typical-for-HN sort of life plan) is if you accumulate a substantial amount of money in your retirement account and then try to transfer it to a different brokerage.
darkhorn 8y ago
Right now I cannot use a payment web site (epay.bg) in Bulgaria because my 10 years old user side (that you install in your web browser) certificate has expired. According to the new rules I need to go to a digital certificate generator company in person with my identification card and buy a user side certificate.
darkhorn 8y ago
In Turkey 2FA is mandatory for online banking. When you renew your SIM card you cannot login to your account. You need to revalidate your identity with additional steps. I think there is an integration between banks and mobile operators because when you renew our SIM card you don't receive SMS code for login even though the phone number is same. Another interesting thing is citizenship web site (turkiye.gov.tr). You can buy your password from a postal office. If you forget you have 2 options; postal office or if you provided via your both phone number and email. With this web site you can login to other web sites like "appointment to hospitals" web site. Furthermore you can login to your turkiye.gov.tr from your bank web site. I forget to mention that I think if you buy from the new Turkish id cards they give you a password and with that password you can login to turkiye.gov.tr. Hovewer there is a microchip within the id card and I'm not sure how it is used for identification. They sell some devices where you place your id and insert it into the USB and you need to install an application. Oh, and in Turkey there is user side certificates too. http://www.turktrust.com.tr/en/products/e-signature/ http://www.turktrust.com.tr/en/products/e-signature/ Another option is so called mobile signatures but I'm not sure how they are used. https://m.turkcell.com.tr/servisler/turkcell-mobil-imza https://m.turkcell.com.tr/servisler/turkcell-mobil-imza
THE_PUN_STOPS 8y ago
I once knew a person that had millions of dollars in liquid banking accounts at one institution with their username and password saved in a contact on their phone!

rhacker 8y ago

I've actually wondered the opposite. If someone is charming enough, and has done some preliminary research on the bank's in-person screening, could they bypass security with something as little as a fake ID? Overall, I don't know if there is a perfect solution. Perhaps for banks we should pee-in-a-cup DNA test in addition to other tests. For a porn site we can do a poor mans email reset.

_dark_matter_ 8y ago
I believe that DNA tests fail the same reason that eye scanners and fingerprints do: they are not private. Almost anyone can get access to any of those 3, and then they just need to figure out a way to use it on the system.
- tedunangst 8y ago
  Is it really that easy to forge someone else's DNA and bring it to a testing facility?
  - tialaramex 8y ago
    DNA is a replicator molecule. You don't need to forge it, just get a tiny sample and it will make as much as you could ever need with gear found in any high school lab.
- rhacker 8y ago
  The bank manager needs to watch you pee. jk
njarboe 8y ago
"If I forget my password, I would like to have to go to the office with my passport to reset it. This person should be high level and well trained so that social engineering is unlikely to work on them." Passport and well trained. If it was clearly a premium option that you paid good money for, the bank or brokerage could have a smart, well trained person handle this. Charge me more than $100, if that what it takes. I think if you eliminate people that don't live in your legal jurisdiction from defrauding you and make them show up somewhere in person (Russian hacker, Nigerian scams) the likelihood of the fraud happening goes down by 3-4 orders of magnitude.
- patio11 8y ago
  This is an option at many financial institutions and often required above a certain level of transaction, but retail customers don't hear about it quite so often because it's in the general category of "If you have to ask, you can't afford it." The magic word is Medallion Signature Guarantee and the mechanism is, basically, "Bank of America is satisfied that we were talking to Bob when we affixed this medallion on this paper and if we were wrong we're good for $500k." The most likely place one is likely to run into this (assuming a typical-for-HN sort of life plan) is if you accumulate a substantial amount of money in your retirement account and then try to transfer it to a different brokerage.

darkhorn 8y ago

Right now I cannot use a payment web site (epay.bg) in Bulgaria because my 10 years old user side (that you install in your web browser) certificate has expired. According to the new rules I need to go to a digital certificate generator company in person with my identification card and buy a user side certificate.

darkhorn 8y ago

In Turkey 2FA is mandatory for online banking. When you renew your SIM card you cannot login to your account. You need to revalidate your identity with additional steps. I think there is an integration between banks and mobile operators because when you renew our SIM card you don't receive SMS code for login even though the phone number is same. Another interesting thing is citizenship web site (turkiye.gov.tr). You can buy your password from a postal office. If you forget you have 2 options; postal office or if you provided via your both phone number and email. With this web site you can login to other web sites like "appointment to hospitals" web site. Furthermore you can login to your turkiye.gov.tr from your bank web site. I forget to mention that I think if you buy from the new Turkish id cards they give you a password and with that password you can login to turkiye.gov.tr. Hovewer there is a microchip within the id card and I'm not sure how it is used for identification. They sell some devices where you place your id and insert it into the USB and you need to install an application. Oh, and in Turkey there is user side certificates too. http://www.turktrust.com.tr/en/products/e-signature/ http://www.turktrust.com.tr/en/products/e-signature/ Another option is so called mobile signatures but I'm not sure how they are used. https://m.turkcell.com.tr/servisler/turkcell-mobil-imza https://m.turkcell.com.tr/servisler/turkcell-mobil-imza

THE_PUN_STOPS 8y ago

I once knew a person that had millions of dollars in liquid banking accounts at one institution with their username and password saved in a contact on their phone!