13 ms·

South African bank advises against the use of password managers

58 points by buyx 7y ago

marvel_boy 7y ago
Half of Android "password managers" are scams.
- rhinoceraptor 7y ago
  I’d bet half of all Android apps are scams.
  - chopin 7y ago
    I bid higher...
    - thrownaway954 7y ago
      I'm sure there is an app that could tell us the true count.
- viraptor 7y ago
  Have you got the numbers for it, and a proof that significant number of people actually use them? Searching for password manager I got to 16th entry before reaching an unknown author and ~40 positions before I reached anything really questionable. Even assuming the install numbers are not inflated, you don't get more than 10k users on the lower entries. There are probably some scams down the list, but claiming half of them are without an explanation is just FUD.
- yxhuvud 7y ago
  While that may or may not be true, I can quite understand why the bank would want to have some certification or something of the password manager to ensure the security. A password manager that is insecure is worse than no password manager.
LilBytes 7y ago
For any customers that do use said bank, take this as an indicator of their own security practices and consider if you still trust them with your money, data and PII. I wonder how they share credentials without a PAM or similar. All service accounts are using 'S3cur3P@$$w0rdzSuck'... Or more probably just a 'passwordz'? What a shocking state of affairs.
- nomad010 7y ago
  I use said bank and they are generally pretty good. Also note they even said in the tweet that they acknowledge the role of password managers so I think you may have read a bit too much into the tweet. Almost every time I log on to their online banking site, I get a page detailing the latest scams and what to look out for. I also agree with their statement for the most part. The general public, at least here in SA, aren't too discerning when it comes to tech matters who will probably download any random app from the play store. If you don't trust pretty much anyone with your credentials, why trust a probably unknown 3rd party with them. I think the best idea in this case is to choose a strong password, try and remember it or write it down and store it in a safe.
- fnbthrowaway 7y ago
  I've been meaning to leave them since they implemented this policy last year. I uninstalled their app and have been getting by using the _Don't Fuck with Paste_ extension [0]. But I do totally agree with you that if they're blocking password manager functionality then it follows that there are probably many more security practices they're similarly getting completely wrong. It's especially concerning when you think of how basic an error this is to be making. I don't know how security policies are written at companies their size, but there are so many resources on the benefits of password managers it's hard to believe no one could google "should you disable copy pasting passwords" and then read any link from the last 10 years which will unambiguously say: No! Another weird security issue I noticed with them last week, is that they seem to have their email template sharepoint public [1]. This could be commonplace, since you can't edit anything, but still seems weird that you would let just anyone traverse your directories. [0] https://chrome.google.com/webstore/detail/dont-fuck-with-paste/nkgllhigpcljnhoakjkgaieabnkmgdkb https://chrome.google.com/webstore/detail/dont-fuck-with-pas... https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/ https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi... [1] https://www.mailers.fnbweb.co.za/Campaigns/Forms/AllItems.aspx?RootFolder=%2FCampaigns%2FMailers%2FOnline https://www.mailers.fnbweb.co.za/Campaigns/Forms/AllItems.as...
mikeash 7y ago
“Bank has idiotic ideas about security” is as surprising as “sun rises at predicted time.” Something about the industry seems to push paranoid incompetence in security.
- moviuro 7y ago
  Currently at a bank's security team, here's what I gathered so far that explains (but doesn't excuse) the current state of affairs: - there are millions of customers who hate having to use their brains (or get their phone to receive a 2FA code); - a kilometer of requirements from whatever Central Bank, local policies and ad-hoc decisions; - (too) limited budget to build and run whatever service (cost of SMS 2FA for millions .vs. cost of some limited fraud); - very, very bad dev education, and general disdain for security. We do have a guide for them (the "secure development handbook"), and all our code audits reveal that it wasn't followed in all places; - outdated perception of security issues (screengrabbers are still a threat to tackle, according to some).
  - mikeash 7y ago
    Thank you for sharing an inside view!
  - zzzcpan 7y ago
    I guess it depends on the country and the bank. My bank, for example, does mandatory 2FA for 15+ years and uses some anomaly based approach to decide how aggressively to ask for 2FA, like if you send money somewhere unusual, it does phone call 2FA, instead of an SMS, and if you just pay your usual bills from the same IP address and the same PC it doesn't even ask for 2FA at all. It also has other optional security features like white lists for IP subnets, internet-only credit cards, etc.
    - zAy0LfpBZLC8mAC 7y ago
      That sounds terrible. I mean, I assume they don't assume liability for bad decisions? If "the PC" or "the IP address" was not contractually agreed to be an authentication factor (that you thus should protect from unauthorized use), it's a terrible idea to use them for authentication, while also (presumably) putting all liability on the customer.
mcv 7y ago
I'm frequently baffled when I encounter a login form that doesn't allow pasting a password. Of course with developer tools I can just remove the attribute that causes that, but plenty of internet users lack that level of technical knowledge and are forced to resort to easy to member and very likely reused passwords. I feel like this is a similar red flag as the 'no single quotes in passwords' limitation that used to be common.
- moviuro 7y ago
  I prefer to use the autotype function of password managers (Ctrl-V on Keepass[0], and rofi-pass[1] for pass(1)); there are other issues with them though (such as "modern" login pages [2]) [0] https://keepass.info/help/base/autotype.html https://keepass.info/help/base/autotype.html [1] https://github.com/carnager/rofi-pass https://github.com/carnager/rofi-pass [2] http://bradfrost.com/blog/post/dont-get-clever-with-login-forms/ http://bradfrost.com/blog/post/dont-get-clever-with-login-fo...
- sonnk 7y ago
  I can understand if a government service requires this but it also happens with a normal, ecommerce website!
  - moviuro 7y ago
    I really don't understand why. Please explain.
  - kelnage 7y ago
    If it's a US Federal Government service, you should point out to them that they are going against the explicit recommendation of NIST[1]. 1. https://pages.nist.gov/800-63-3/sp800-63b.html#sec5 https://pages.nist.gov/800-63-3/sp800-63b.html#sec5, under 5.1.1.2 Memorized Secret Verifiers, 'Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret.'
    - 0xffff2 7y ago
      Sadly the US Federal Government is a massive and unwieldy collection of organizations. I work in the Federal government and my part of it doesn't comply with NIST's modern guidelines at all. They probably will at some point, but department/agency level IT changes take years to be approved.
angry_octet 7y ago
If you can only remember a few long term complex secrets, then using one slot for your bank password seems reasonable to me. The other big ones for me are: google/microsoft account, password manager, FDE passphrase. If you use hardware 2FA and have lots of bank accounts (business, trading, etc) then using a password manager starts to make sense.
peterwwillis 7y ago
Password managers are a very useful idea for general accounts, but I would not trust my financial solvency to them. If you only have one or two bank accounts, generate a long complex password, memorize it, don't save it anywhere, and use a mnemonic or other method to vary the password between the two accounts. Even if password managers are implemented perfectly, there are various attacks that they can still fall victim to that a memorized password won't. Most password managers are not implemented perfectly.
- consp 7y ago
  > a memorized password won't Memorized password are usually highly insecure due to being reused and short in general. So they are usually implemented as imperfect systems for most people. What is the difference to a password manager here? The fact you remember long passwords doesn't mean everyone does.
  - peterwwillis 7y ago
    If you're the type of person who uses no master password, and every password you would ever create is '1234', then a password manager will be a definite improvement. But if you have the ability to memorize two complex passwords, that is more secure. My advice is solely for the person who already has a password manager, has memorized one complex password for it, and is willing to memorize another one.
- kranner 7y ago
  Name one attack that would work against a non-cloud-based password manager like pass. Note that the encrypted passwords are stored locally and are encrypted with GPG and protected with a (hopefully) complex passphrase. If your answer depends on malware that can read the clipboard, note that the same malware can also log the keystrokes used to type the password manually.
  - peterwwillis 7y ago
    Evil maid. Cold boot. Memory parsing. Clipboard/key event hooking. Brute force. Dictionary. Autofill hijack. You can use the first four against typed passwords, but you either need to have malware installed, or your time window has to be very short. All of these can be used against password managers even without malware, and the time window is much longer, often due to crappy password managers not properly protecting against side channels or even cleaning up old memory. You have the same attacks as with entering a password, plus more you wouldn't have had.
arunc 7y ago
American Banks are no different, they just don't tell you out loud. Here's a similar thing with Citi Bank credit card. https://twitter.com/aruncxy/status/1163447301592891392?s=09 https://twitter.com/aruncxy/status/1163447301592891392?s=09
- c17r 7y ago
  I have a 30 character password with upper, lower, numbers, and special characters for Citi and Bitwarden works just fine on their website. What problems are you running into?
izzydata 7y ago
Aren't password managers sacrificing security for convenience? Remembering hundreds of long unique passwords being the most secure, but too difficult. If you could remember everything then you would have an uncompromisable storage system. Personally I use password managers for most things, but exclude them when money is involved and opt to remember those.
- ceejayoz 7y ago
  In a world where people have perfect, secure memories, sure. We don't live in that world, and as such, a good password manager is the most practically secure method for the vast majority of folks.
- oconnor663 7y ago
  One of the security features that a password manager provides is retrieving passwords based on what domain you're on. They're a lot better than the human brain at making sure you don't get phished by an evil site that looks exactly like Gmail or whatever.
  - izzydata 7y ago
    I'd like to believe I know better than that, but I see your point.
- viraptor 7y ago
  > Aren't password managers sacrificing security for convenience? It depends on what problem you're trying to solve / what's your threat model. The comparison is for realistic (imperfect) use of password manager vs what someone would do otherwise. Nobody is likely to ever guess your bank password with online tries, so the likely scenarios are: protection from hashed credentials leak, and from another service leaking shared passwords. The tradeoff is your password manager bring possibly exploited. With the known frequency of each so far, no, it doesn't look like we're sacrificing security.
sonnk 7y ago
Even this is a wrong move from the bank, I think that using password to have access to sensible service is not the safest way. Would be better if the bank can use some ID-verification service, preferably provided by the government independent company.
alkonaut 7y ago
Is there no 2FA? Why is there a password field at all on an online banking page?
- sp332 7y ago
  Do you mean logging in with a one-time code instead of a password? It might be more secure than a password, but it's still only one "factor".
  - alkonaut 7y ago
    No I mean a physical thing like those little number generators that banks have had for what 20 years now, or the smartphone 2FA apps that we have used for at least 15 years. I don't enter either a regular password nor one-time password for anything (not for transactions, not for login). I only use an identifying mechanism on a second device (a smartphone or a dedicated device). The secondary device has an 8digit pin though, so if it is stolen then it's not (immediately) compromising the security.
    - sp332 7y ago
      Yeah that is a one-time code. It's in the name: https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_a... And again, if you use only this to log in, it's not two-factor authentication because it's only one factor. You'd have to combine it with something else (like a password or a fingerprint) to have two factors.
      - alkonaut 7y ago
        The rsa OTP-digit generator thing is an OTP, but what about signing with a device that doesn't generate a visible OTP? My authenticator app just asks me to produce my pin into the smartphone app and then the waiting transaction completes automatically in the computer web browser. I suppose it could be an OTP too, but just not "manually entered"? Is there a name for this type of authentication? It's just one factor but I do it on a separate device I mean.
caseysoftware 7y ago
Thirty minutes ago I closed my account with Wells Fargo because of their lack of security. Last month, they called to validate my identity. I called back, they asked for my mother's maiden name. Me: "Since that information is on Facebook, I use a big random string starting.." Them: "That's good enough, so what we want to talk about is.." Then when I went into the local branch, the receptionist wanted to swipe my debit card in their tablet to add me to the line. Forget that, I'm out.
tibbydudeza 7y ago
Considering how much S.A banks charge us in service fees they can afford to give folks who uses online banking a security fob.
zxcvbn4038 7y ago
Over the weekend I had to call Time Warner Cable for support. Their support representative was willing to send an e-mail verification to any address I provided - in fact she refused to send an e-mail to the address on file because she couldn’t be sure the address was valid or who she was sending too. All this when I accessed a live chat feature from within a logged in context where I had already authenticated myself.

58 points by buyx 7y ago

marvel_boy 7y ago

Half of Android "password managers" are scams.

rhinoceraptor 7y ago
I’d bet half of all Android apps are scams.
- chopin 7y ago
  I bid higher...
  - thrownaway954 7y ago
    I'm sure there is an app that could tell us the true count.
viraptor 7y ago
Have you got the numbers for it, and a proof that significant number of people actually use them? Searching for password manager I got to 16th entry before reaching an unknown author and ~40 positions before I reached anything really questionable. Even assuming the install numbers are not inflated, you don't get more than 10k users on the lower entries. There are probably some scams down the list, but claiming half of them are without an explanation is just FUD.
yxhuvud 7y ago
While that may or may not be true, I can quite understand why the bank would want to have some certification or something of the password manager to ensure the security. A password manager that is insecure is worse than no password manager.

LilBytes 7y ago

For any customers that do use said bank, take this as an indicator of their own security practices and consider if you still trust them with your money, data and PII. I wonder how they share credentials without a PAM or similar. All service accounts are using 'S3cur3P@$$w0rdzSuck'... Or more probably just a 'passwordz'? What a shocking state of affairs.

nomad010 7y ago
I use said bank and they are generally pretty good. Also note they even said in the tweet that they acknowledge the role of password managers so I think you may have read a bit too much into the tweet. Almost every time I log on to their online banking site, I get a page detailing the latest scams and what to look out for. I also agree with their statement for the most part. The general public, at least here in SA, aren't too discerning when it comes to tech matters who will probably download any random app from the play store. If you don't trust pretty much anyone with your credentials, why trust a probably unknown 3rd party with them. I think the best idea in this case is to choose a strong password, try and remember it or write it down and store it in a safe.
fnbthrowaway 7y ago
I've been meaning to leave them since they implemented this policy last year. I uninstalled their app and have been getting by using the _Don't Fuck with Paste_ extension [0]. But I do totally agree with you that if they're blocking password manager functionality then it follows that there are probably many more security practices they're similarly getting completely wrong. It's especially concerning when you think of how basic an error this is to be making. I don't know how security policies are written at companies their size, but there are so many resources on the benefits of password managers it's hard to believe no one could google "should you disable copy pasting passwords" and then read any link from the last 10 years which will unambiguously say: No! Another weird security issue I noticed with them last week, is that they seem to have their email template sharepoint public [1]. This could be commonplace, since you can't edit anything, but still seems weird that you would let just anyone traverse your directories. [0] https://chrome.google.com/webstore/detail/dont-fuck-with-paste/nkgllhigpcljnhoakjkgaieabnkmgdkb https://chrome.google.com/webstore/detail/dont-fuck-with-pas... https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/ https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi... [1] https://www.mailers.fnbweb.co.za/Campaigns/Forms/AllItems.aspx?RootFolder=%2FCampaigns%2FMailers%2FOnline https://www.mailers.fnbweb.co.za/Campaigns/Forms/AllItems.as...

mikeash 7y ago

“Bank has idiotic ideas about security” is as surprising as “sun rises at predicted time.” Something about the industry seems to push paranoid incompetence in security.

moviuro 7y ago
Currently at a bank's security team, here's what I gathered so far that explains (but doesn't excuse) the current state of affairs: - there are millions of customers who hate having to use their brains (or get their phone to receive a 2FA code); - a kilometer of requirements from whatever Central Bank, local policies and ad-hoc decisions; - (too) limited budget to build and run whatever service (cost of SMS 2FA for millions .vs. cost of some limited fraud); - very, very bad dev education, and general disdain for security. We do have a guide for them (the "secure development handbook"), and all our code audits reveal that it wasn't followed in all places; - outdated perception of security issues (screengrabbers are still a threat to tackle, according to some).
- mikeash 7y ago
  Thank you for sharing an inside view!
- zzzcpan 7y ago
  I guess it depends on the country and the bank. My bank, for example, does mandatory 2FA for 15+ years and uses some anomaly based approach to decide how aggressively to ask for 2FA, like if you send money somewhere unusual, it does phone call 2FA, instead of an SMS, and if you just pay your usual bills from the same IP address and the same PC it doesn't even ask for 2FA at all. It also has other optional security features like white lists for IP subnets, internet-only credit cards, etc.
  - zAy0LfpBZLC8mAC 7y ago
    That sounds terrible. I mean, I assume they don't assume liability for bad decisions? If "the PC" or "the IP address" was not contractually agreed to be an authentication factor (that you thus should protect from unauthorized use), it's a terrible idea to use them for authentication, while also (presumably) putting all liability on the customer.

mcv 7y ago

I'm frequently baffled when I encounter a login form that doesn't allow pasting a password. Of course with developer tools I can just remove the attribute that causes that, but plenty of internet users lack that level of technical knowledge and are forced to resort to easy to member and very likely reused passwords. I feel like this is a similar red flag as the 'no single quotes in passwords' limitation that used to be common.

moviuro 7y ago
I prefer to use the autotype function of password managers (Ctrl-V on Keepass[0], and rofi-pass[1] for pass(1)); there are other issues with them though (such as "modern" login pages [2]) [0] https://keepass.info/help/base/autotype.html https://keepass.info/help/base/autotype.html [1] https://github.com/carnager/rofi-pass https://github.com/carnager/rofi-pass [2] http://bradfrost.com/blog/post/dont-get-clever-with-login-forms/ http://bradfrost.com/blog/post/dont-get-clever-with-login-fo...
sonnk 7y ago
I can understand if a government service requires this but it also happens with a normal, ecommerce website!
- moviuro 7y ago
  I really don't understand why. Please explain.
- kelnage 7y ago
  If it's a US Federal Government service, you should point out to them that they are going against the explicit recommendation of NIST[1]. 1. https://pages.nist.gov/800-63-3/sp800-63b.html#sec5 https://pages.nist.gov/800-63-3/sp800-63b.html#sec5, under 5.1.1.2 Memorized Secret Verifiers, 'Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret.'
  - 0xffff2 7y ago
    Sadly the US Federal Government is a massive and unwieldy collection of organizations. I work in the Federal government and my part of it doesn't comply with NIST's modern guidelines at all. They probably will at some point, but department/agency level IT changes take years to be approved.

angry_octet 7y ago

If you can only remember a few long term complex secrets, then using one slot for your bank password seems reasonable to me. The other big ones for me are: google/microsoft account, password manager, FDE passphrase. If you use hardware 2FA and have lots of bank accounts (business, trading, etc) then using a password manager starts to make sense.

peterwwillis 7y ago

Password managers are a very useful idea for general accounts, but I would not trust my financial solvency to them. If you only have one or two bank accounts, generate a long complex password, memorize it, don't save it anywhere, and use a mnemonic or other method to vary the password between the two accounts. Even if password managers are implemented perfectly, there are various attacks that they can still fall victim to that a memorized password won't. Most password managers are not implemented perfectly.

consp 7y ago
> a memorized password won't Memorized password are usually highly insecure due to being reused and short in general. So they are usually implemented as imperfect systems for most people. What is the difference to a password manager here? The fact you remember long passwords doesn't mean everyone does.
- peterwwillis 7y ago
  If you're the type of person who uses no master password, and every password you would ever create is '1234', then a password manager will be a definite improvement. But if you have the ability to memorize two complex passwords, that is more secure. My advice is solely for the person who already has a password manager, has memorized one complex password for it, and is willing to memorize another one.
kranner 7y ago
Name one attack that would work against a non-cloud-based password manager like pass. Note that the encrypted passwords are stored locally and are encrypted with GPG and protected with a (hopefully) complex passphrase. If your answer depends on malware that can read the clipboard, note that the same malware can also log the keystrokes used to type the password manually.
- peterwwillis 7y ago
  Evil maid. Cold boot. Memory parsing. Clipboard/key event hooking. Brute force. Dictionary. Autofill hijack. You can use the first four against typed passwords, but you either need to have malware installed, or your time window has to be very short. All of these can be used against password managers even without malware, and the time window is much longer, often due to crappy password managers not properly protecting against side channels or even cleaning up old memory. You have the same attacks as with entering a password, plus more you wouldn't have had.

arunc 7y ago

American Banks are no different, they just don't tell you out loud. Here's a similar thing with Citi Bank credit card. https://twitter.com/aruncxy/status/1163447301592891392?s=09 https://twitter.com/aruncxy/status/1163447301592891392?s=09

c17r 7y ago
I have a 30 character password with upper, lower, numbers, and special characters for Citi and Bitwarden works just fine on their website. What problems are you running into?

izzydata 7y ago

Aren't password managers sacrificing security for convenience? Remembering hundreds of long unique passwords being the most secure, but too difficult. If you could remember everything then you would have an uncompromisable storage system. Personally I use password managers for most things, but exclude them when money is involved and opt to remember those.

ceejayoz 7y ago
In a world where people have perfect, secure memories, sure. We don't live in that world, and as such, a good password manager is the most practically secure method for the vast majority of folks.
oconnor663 7y ago
One of the security features that a password manager provides is retrieving passwords based on what domain you're on. They're a lot better than the human brain at making sure you don't get phished by an evil site that looks exactly like Gmail or whatever.
- izzydata 7y ago
  I'd like to believe I know better than that, but I see your point.
viraptor 7y ago
> Aren't password managers sacrificing security for convenience? It depends on what problem you're trying to solve / what's your threat model. The comparison is for realistic (imperfect) use of password manager vs what someone would do otherwise. Nobody is likely to ever guess your bank password with online tries, so the likely scenarios are: protection from hashed credentials leak, and from another service leaking shared passwords. The tradeoff is your password manager bring possibly exploited. With the known frequency of each so far, no, it doesn't look like we're sacrificing security.

sonnk 7y ago

Even this is a wrong move from the bank, I think that using password to have access to sensible service is not the safest way. Would be better if the bank can use some ID-verification service, preferably provided by the government independent company.

alkonaut 7y ago

Is there no 2FA? Why is there a password field at all on an online banking page?

sp332 7y ago
Do you mean logging in with a one-time code instead of a password? It might be more secure than a password, but it's still only one "factor".
- alkonaut 7y ago
  No I mean a physical thing like those little number generators that banks have had for what 20 years now, or the smartphone 2FA apps that we have used for at least 15 years. I don't enter either a regular password nor one-time password for anything (not for transactions, not for login). I only use an identifying mechanism on a second device (a smartphone or a dedicated device). The secondary device has an 8digit pin though, so if it is stolen then it's not (immediately) compromising the security.
  - sp332 7y ago
    Yeah that is a one-time code. It's in the name: https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_a... And again, if you use only this to log in, it's not two-factor authentication because it's only one factor. You'd have to combine it with something else (like a password or a fingerprint) to have two factors.
    - alkonaut 7y ago
      The rsa OTP-digit generator thing is an OTP, but what about signing with a device that doesn't generate a visible OTP? My authenticator app just asks me to produce my pin into the smartphone app and then the waiting transaction completes automatically in the computer web browser. I suppose it could be an OTP too, but just not "manually entered"? Is there a name for this type of authentication? It's just one factor but I do it on a separate device I mean.

caseysoftware 7y ago

Thirty minutes ago I closed my account with Wells Fargo because of their lack of security. Last month, they called to validate my identity. I called back, they asked for my mother's maiden name. Me: "Since that information is on Facebook, I use a big random string starting.." Them: "That's good enough, so what we want to talk about is.." Then when I went into the local branch, the receptionist wanted to swipe my debit card in their tablet to add me to the line. Forget that, I'm out.

tibbydudeza 7y ago

Considering how much S.A banks charge us in service fees they can afford to give folks who uses online banking a security fob.

zxcvbn4038 7y ago

Over the weekend I had to call Time Warner Cable for support. Their support representative was willing to send an e-mail verification to any address I provided - in fact she refused to send an e-mail to the address on file because she couldn’t be sure the address was valid or who she was sending too. All this when I accessed a live chat feature from within a logged in context where I had already authenticated myself.