5 ms·

On the topic of banks and software, I can't understand for the life of me why almost all of the banks in Canada and US have comical level of security. Most don'

by ncann 6y ago

On the topic of banks and software, I can't understand for the life of me why almost all of the banks in Canada and US have comical level of security. Most don't offer 2FA (of all the banks on Canada, the only one with 2FA is TD if I recall). Those who do only have 2FA through SMS so good luck travelling out of country. Many still have pin-only passwords with 4-8 digits limit...

phist_mcgee 6y ago
Good old fashioned legacy systems. Decades and decades of consultants throwing garbage at more garbage. Endless uplift projects and corporate reshuffles slicing tech stacks in two, and sewing them back up. Banks are utterly famous for this stuff, and I think the new trend at least here in Australia is to start spin off 'neobanks' that begin with a fresh slate, but are still owned by their parent bank.
Vespasian 6y ago
Probably they not legally mandated to offer it and are not liable for hacked accounts. A few years back a German/EU law required banks to introduce real 2fa for customer logins and payments. The deadline had to be extended several times and still some banks and merchants missed it.
mschuster91 6y ago
> On the topic of banks and software, I can't understand for the life of me why almost all of the banks in Canada and US have comical level of security. Multiple reasons: 1) They're banks. Banks are run by the worst type of MBA beancounters you can imagine - all that counts is profits (and the more the better, which is why way too many banks dabble in investment banking aka legalized gambling), and IT doesn't bring in profits, so generally bank IT is only doing the utterly minimal effort that is required to stay in compliance with regulatory demands. As you can imagine, they're pretty much overwhelmed when they get requirements that require overhauls - e.g. the EU mandating overnight SEPA transfers or real-time identity confirmation (PSD2). 2) The tech stacks are comically old and complex (which is the reason for pin-only passwords). The decades-old mainframe stack with hundreds of custom built applications interfacing to it means that even something as innocent as alphanumeric passwords may be all but impossible to do. And don't get me started on Unicode, you're lucky if the base minimum that all connected applications understand is something like ISO-8859. 3) Related to this: as the software is so old, it literally embodies decades of knowledge of all possible kind of "edge cases" and hidden assumptions. Like... developers assume that a dead person stays dead, which is a sane thing to believe since zombies aren't real, but then you have someone declared dead by court reappear alive, and suddenly the workflow breaks down. Or that someone who registered as male can't change their legal gender, or that there are only two genders (which is quite fucking over many many MANY industries who implemented gender as a boolean, e.g. is_female), or that a marriage exclusively consists of husband and wife (changing that one is costing the public sector an awful lot of work, even many years after same-sex marriage got legalized in Germany). 4) Security audits in big companies (not just banks) are just checklists for insurance vendors, no matter if they actually make sense or not. All that matters for the C-level execs is "assuming someone hacks us, will insurance find a way to deny payments?" and not "is this actually secure?". 5) Regulatory agencies are so risk averse it hurts. What they don't know for years is haram - Kubernetes? Cloud hosting? Even proposing that will get you as a developer a shoot-down order from legal, since the regulatory agencies won't certify it. Source: done a couple jobs involving either interfacing or directly working with medical and banking services.
- bobbydreamer 6y ago
  Please mainframes are not old, most of the mainframe machines used by all top 50 banks are latest. Programs running in mainframes may be old as they are backward compatible. Policy is don't change it unless it breaks. So devs in mainframe get to work on new projects or optimise existing code. Front-end(offhost) Keeps changing regularly....
- ncann 6y ago
  Thank you for the detailed answer! It's too bad that unless there's government regulations banks will not have 2FA in the foreseeable future. Such a shame.
ssijak 6y ago
When I travel out of country I stick my SIM card in some old rooted android phone and configure it to forward sms messages to my email, only because of banking 2fs sms messages
- ncann 6y ago
  That's actually a really nice idea. Do you have a specific app that you use for that?
cutler 6y ago
One of my credit card/bank accounts - I forget which - didn't allow the use of non-alphabetic characters when I was setting-up the password.
Ayesh 6y ago
I think perhaps US being an exception, receiving SMSs is free even when you are roaming. Many android phones have dual physical SIM cards, so when I travel, I still keep my bank-registered number on roaming. But I totally agree with your point - of all places, Banks are probably WORST with 2FA. No U2F or even TOTP. There was one bank where I live that offered thise battery powered RSA physical tokens, but they are way worse in practicality.
camjohnson26 6y ago
Most crypto websites I’ve used have way better security than my banks. Can get into the bank with a password, crypto requires 2fa, email confirmation, captchas, all kinds of checks.

by ncann 6y ago

phist_mcgee 6y ago

Good old fashioned legacy systems. Decades and decades of consultants throwing garbage at more garbage. Endless uplift projects and corporate reshuffles slicing tech stacks in two, and sewing them back up. Banks are utterly famous for this stuff, and I think the new trend at least here in Australia is to start spin off 'neobanks' that begin with a fresh slate, but are still owned by their parent bank.

Vespasian 6y ago

Probably they not legally mandated to offer it and are not liable for hacked accounts. A few years back a German/EU law required banks to introduce real 2fa for customer logins and payments. The deadline had to be extended several times and still some banks and merchants missed it.

mschuster91 6y ago

> On the topic of banks and software, I can't understand for the life of me why almost all of the banks in Canada and US have comical level of security. Multiple reasons: 1) They're banks. Banks are run by the worst type of MBA beancounters you can imagine - all that counts is profits (and the more the better, which is why way too many banks dabble in investment banking aka legalized gambling), and IT doesn't bring in profits, so generally bank IT is only doing the utterly minimal effort that is required to stay in compliance with regulatory demands. As you can imagine, they're pretty much overwhelmed when they get requirements that require overhauls - e.g. the EU mandating overnight SEPA transfers or real-time identity confirmation (PSD2). 2) The tech stacks are comically old and complex (which is the reason for pin-only passwords). The decades-old mainframe stack with hundreds of custom built applications interfacing to it means that even something as innocent as alphanumeric passwords may be all but impossible to do. And don't get me started on Unicode, you're lucky if the base minimum that all connected applications understand is something like ISO-8859. 3) Related to this: as the software is so old, it literally embodies decades of knowledge of all possible kind of "edge cases" and hidden assumptions. Like... developers assume that a dead person stays dead, which is a sane thing to believe since zombies aren't real, but then you have someone declared dead by court reappear alive, and suddenly the workflow breaks down. Or that someone who registered as male can't change their legal gender, or that there are only two genders (which is quite fucking over many many MANY industries who implemented gender as a boolean, e.g. is_female), or that a marriage exclusively consists of husband and wife (changing that one is costing the public sector an awful lot of work, even many years after same-sex marriage got legalized in Germany). 4) Security audits in big companies (not just banks) are just checklists for insurance vendors, no matter if they actually make sense or not. All that matters for the C-level execs is "assuming someone hacks us, will insurance find a way to deny payments?" and not "is this actually secure?". 5) Regulatory agencies are so risk averse it hurts. What they don't know for years is haram - Kubernetes? Cloud hosting? Even proposing that will get you as a developer a shoot-down order from legal, since the regulatory agencies won't certify it. Source: done a couple jobs involving either interfacing or directly working with medical and banking services.

bobbydreamer 6y ago
Please mainframes are not old, most of the mainframe machines used by all top 50 banks are latest. Programs running in mainframes may be old as they are backward compatible. Policy is don't change it unless it breaks. So devs in mainframe get to work on new projects or optimise existing code. Front-end(offhost) Keeps changing regularly....
ncann 6y ago
Thank you for the detailed answer! It's too bad that unless there's government regulations banks will not have 2FA in the foreseeable future. Such a shame.

ssijak 6y ago

When I travel out of country I stick my SIM card in some old rooted android phone and configure it to forward sms messages to my email, only because of banking 2fs sms messages

ncann 6y ago
That's actually a really nice idea. Do you have a specific app that you use for that?

cutler 6y ago

One of my credit card/bank accounts - I forget which - didn't allow the use of non-alphabetic characters when I was setting-up the password.

Ayesh 6y ago

I think perhaps US being an exception, receiving SMSs is free even when you are roaming. Many android phones have dual physical SIM cards, so when I travel, I still keep my bank-registered number on roaming. But I totally agree with your point - of all places, Banks are probably WORST with 2FA. No U2F or even TOTP. There was one bank where I live that offered thise battery powered RSA physical tokens, but they are way worse in practicality.

camjohnson26 6y ago

Most crypto websites I’ve used have way better security than my banks. Can get into the bank with a password, crypto requires 2fa, email confirmation, captchas, all kinds of checks.