3 ms·
Cory Doctorow highlighted a particularly 'head-desk' example of challenge questions' failure modes yesterday – a credit union that mixes the user's free-form an
by gojomo 6y ago
Cory Doctorow highlighted a particularly 'head-desk' example of challenge questions' failure modes yesterday – a credit union that mixes the user's free-form answer (which might be an attempt at a strong password) with mundane alternate responses in a multiple-choice presentation:
https://twitter.com/doctorow/status/1289214916960780291 https://twitter.com/doctorow/status/1289214916960780291
Whenever you think you've seen the dumbest bit of anti-secure design, some bank, airline, or government will provide a "hold my beer" topper.
- aptwebapps 6y agoOh, man that's bad. The worst I've come across in the wild was some bank or financial institution (don't remember which one) which did some "sensible" validation at creation time. I.e., your first phone number had to look like a phone number, your mother's birth date had to be a real date, etc. That was pretty bad but you could still choose the phone number one and get a reasonably decent password. This is way worse.
- philjohn 6y agoBanks are just abysmal pretty much across the board. From things they should know better about (2FA over SMS) to just inexcusable - BarclayCard in the UK has accounts protected by a 6 digit pin and a secret word that needs to be a minimum of 6 characters long. No 2FA options available.