3 ms·

Banking security is a joke. My bank calls me to talk to me and insists I give them my date of birth and address to ‘verify’ myself. Meaning anyone can call me

Banking security is a joke. My bank calls me to talk to me and insists I give them my date of birth and address to ‘verify’ myself. Meaning anyone can call me, pretend to be my bank, I am supposed to give them this info, and then they have what they need to verify themself as me. Banks are dumb.

anonsivalley652 7y ago
I did some tech consulting with some ex-banking Wall St. consultants. It's not a monolith. That industry is very conservative.. and some companies get so frozen in time that they become complacent and go full Equifax. They're always playing catch-up because every criminal and most people would like to rob a bank without a gun, so their threats are numerous and perpetual. (And then there's Wells Fargo.) It seems like banks should adopt that credit-file-based challenge protocol with the multiple choice questions containing ~50% or so spurious data that answers (None of these). I had to do it to reset a hospital's patient login for myself the other day. DOB, SSN, address, phone number aren't secret-enough "things you know" or "things you can do." For signatures, I always sign a smiley face because they're completely worthless. Perhaps even better would be to: 0. have the bank have a relationship with the customer 1. issue 2FA device or soft-2FA 2. use per-customer colors, pictures and words on the password screen to deter impersonation and phishing attacks 3. It seems like hardware is so cheap these days, the bank could issue customers a hardened tablet with a pin, biometrics & face recognition that VPN'ed back to them and functioned only for their banking apps. It's much easier to support and harden one controlled device than zillions of likely malware-infected Chrome on Windows 10 or macOS Catalina's Safari on unsecured public WiFi.
- gruez 7y ago
  >2. use per-customer colors, pictures and words on the password screen to deter impersonation and phishing attacks I've seen this on multiple sites, and I always thought it was snakeoil. All you need to do to bypass it would be to make your phishing server contact tho bank to request the per-customer color/picture/word.
- jonplackett 7y ago
  What is particularly wrong with Catalina on unsecured public WiFi? Are you just making a pint about public WiFi or is there something wrong with Catalina?

anonsivalley652 7y ago

I did some tech consulting with some ex-banking Wall St. consultants. It's not a monolith. That industry is very conservative.. and some companies get so frozen in time that they become complacent and go full Equifax. They're always playing catch-up because every criminal and most people would like to rob a bank without a gun, so their threats are numerous and perpetual. (And then there's Wells Fargo.) It seems like banks should adopt that credit-file-based challenge protocol with the multiple choice questions containing ~50% or so spurious data that answers (None of these). I had to do it to reset a hospital's patient login for myself the other day. DOB, SSN, address, phone number aren't secret-enough "things you know" or "things you can do." For signatures, I always sign a smiley face because they're completely worthless. Perhaps even better would be to: 0. have the bank have a relationship with the customer 1. issue 2FA device or soft-2FA 2. use per-customer colors, pictures and words on the password screen to deter impersonation and phishing attacks 3. It seems like hardware is so cheap these days, the bank could issue customers a hardened tablet with a pin, biometrics & face recognition that VPN'ed back to them and functioned only for their banking apps. It's much easier to support and harden one controlled device than zillions of likely malware-infected Chrome on Windows 10 or macOS Catalina's Safari on unsecured public WiFi.

gruez 7y ago
>2. use per-customer colors, pictures and words on the password screen to deter impersonation and phishing attacks I've seen this on multiple sites, and I always thought it was snakeoil. All you need to do to bypass it would be to make your phishing server contact tho bank to request the per-customer color/picture/word.
jonplackett 7y ago
What is particularly wrong with Catalina on unsecured public WiFi? Are you just making a pint about public WiFi or is there something wrong with Catalina?