2 ms·

> Not running some kind of "one account per access device" sanity check is insane So I would need different accounts for my personal computer, my laptop, offic

• ctdonath 15y ago
  It's a sanity check, not an absolute limitation. My bank DOES (as I detailed) require positive-feedback verification that any attempt to use more than "one account per access device" is in fact authorized by the account holder. Any time I use a new access device, they email/text to a known address/phone a verification code which I must feed back before the login proceeds. The sanity check is: if the account is being accessed from a device not used before, the legitimacy is suspect until confirmed. This in contrast to the lead story, where some 200,000 accounts were accessed from a very small number of computers clearly not authorized by the account holders - achieved because not even a basic sanity check was performed. Heck, the servers didn't even notice that no login process was performed for the accounts, much less track which devices the account holders tended to use.