It's dumbfounding how awful bank websites are at security. They started with the stupidest conceivable way to implement two-factor--a second clear-text password

It's dumbfounding how awful bank websites are at security. They started with the stupidest conceivable way to implement two-factor--a second clear-text password that is an answer to a very small number of secret questions. Then they limited the secret questions to things people could find out about you on Facebook, then on top of that added secret questions about esoteric crap like your father's mother's childhood neighbor's dog's name, secret questions that have answers that vary over time like your favorite song, secret questions that have ridiculous length or punctuation requirements, authentication by SMS, authentication by robocall, and on and on and on. The only thing they absolutely refuse to try is an actual friggin' two-factor app! There's security theater, and then there's Punch and Judy security puppet shows.