3 ms·
Do you really think the only thing the bank does to log people on is to check the username and password? Banks are way more sophisticated than this and it goes
by 0x3RO 7y ago
Do you really think the only thing the bank does to log people on is to check the username and password? Banks are way more sophisticated than this and it goes well beyond merely string-matching credentials; there's all sorts of other environment, behavioral and heuristic patterns used to establish legitimacy. Even if you rose this issue with the bank, they'll hardly change their modes of operation, and you certainly won't ever see a bank telling you how they do it, but those "hidden security features" make a significant contribution to the bank's security posture; ie: https://twitter.com/mbna/status/1016270694299127809?s=20 https://twitter.com/mbna/status/1016270694299127809?s=20
- dwnvoted2hell 7y agohttps://yourlogicalfallacyis.com/no-true-scotsman https://yourlogicalfallacyis.com/no-true-scotsman Fallacy much?
- gruez 7y ago>but those "hidden security features" make a significant contribution to the bank's security posture Which is totally bullshit because I have RFP enabled in firefox, and I get asked for my security question on every log in, even though my password is randomly generated and reasonably secure.
- 0x3RO 7y agoIn addition to this, you might be interested enough to take note of a number of your banks arbitrary password rules, that one could follow to make similarly negative assumptions. ie; "hey [bank], because my password is limited to 16 characters, does that mean you've got a varchar(16) column somewhere storing plaintext?"