5 ms·

I have multiple financial accounts that still insist on using public-knowledge security questions (which of course I've given fake answers saved in my password

I have multiple financial accounts that still insist on using public-knowledge security questions (which of course I've given fake answers saved in my password manager) instead of just letting me set up proper 2FA. It's infuriating.

stjohnswarts 5y ago
Yeah my bank does this. I've been meaning to call around and find a credit union that has 2FA and doesn't require this garbage. I changed my questions to a randomly generated password and put it in my password manager.
jliptzin 5y ago
Citibank is particularly egregious. 8 character MAXIMUM length, lots of special characters not permitted while requiring numbers and letters, forced password changing every few months, I absolutely hate it.
- ptk 5y ago
  Are you speaking as an employee or a customer? I just checked my password db for a few Citibank accounts and all of them were far longer than 8 characters.
  - jliptzin 5y ago
    For my CitiBusiness account, not my personal accounts
kibwen 5y ago
Treating security questions like passwords and saving them in your password manager is correct, but make sure that your fake answers aren't autogenerated nonsense like ":s^Twd.J;3hzg=Q~". Many password reset flows involve communicating a security question over the phone, and it's easy enough for an attacker to guess "oh, it's just a bunch of random characters lol" and for the phone rep to just laugh and shrug their shoulders and let the person in. Make sure it's a sentence that makes sense (I would even avoid non-sequitur passphrases such as those generated by diceware), while also making sure that it has no relationship whatsoever to the question.
- js2 5y ago
  openssl rand -hex 8 | sed 's/..../&-/g;s/-$//' Or if you like upper-case letters: openssl rand -hex 8 | sed 's/..../&-/g;s/-$//;y/abcdef/ABCDEF/
  - exolymph 5y ago
    This would still parse as "random letters and numbers" to your typical support agent, no?
    - js2 5y ago
      Maybe, but it's close to what I use. It's a limited character set and more or less looks like a credit-card which people are used to seeing. It's either that or pick a random dictionary word.
  - deleted 5y ago
    [deleted]
- time0ut 5y ago
  My password generator can make pronounceable nonsense words. It has worked ok so far. Some of them are embarrassing though.
  - fragmede 5y ago
    My password generator (or just do it manually) can generate word passwords like correct-horse-battery-staple using real words, which is probably a bit easier to read over the phone.
    - Symbiote 5y ago
      grep --perl-regexp '^[a-z]{4,7}$' /usr/share/dict/words | \ shuf -n 5 | tr '\n' ' ' Although maybe just 2 or 3 words would be best for avoiding a support agent skipping the question. bless clench moraine
matheusmoreira 5y ago
Yeah, my bank does that too. Asks for my birthday for "security" reasons. They also kill their website's usability by forbidding physical keyboards and forcing users to use a virtual keyboard with randomized key layouts in order to type passwords in a feeble attempt to defeat keyloggers. Some banks even make it extra annoying by generating ambiguous keys like "1 or 7" or "2 or 3". The saddest thing is banks can't be too secure. If they were, then they would be too hard for normal people to use and they would get locked out of their funds.
- kortex 5y ago
  I imagine it also disables autofill from password managers (since it's not actually a form field)? I would literally close out my account in that very moment if my bank did that. Not only because that's horribly inconvenient and I would never put up with it, but it also shows they have no idea what are sane security measures or not.
  - matheusmoreira 5y ago
    > I imagine it also disables autofill from password managers (since it's not actually a form field)? Yes. They also force users to install literal malware into their computers masquerading as a "security module". Not only is it invasive, it slows down everything to a crawl. I tried to reverse engineer one such module and caught it intercepting every single network connection. It also used to force install itself into browsers as an extension, no doubt in order to intercept data. > I would literally close out my account in that very moment if my bank did that. That's exactly what I did. Chose a smaller bank that somehow didn't use this malware. The least bad option.
- pitay 5y ago
  My bank used to have a virtual keypad, they now have a normal password field. So they actually saw reason. I think there is reason to be optimistic about bank password security getting better; what is known to be good password policies and interfaces are getting more widespread. It may take some time, but it should get better because it is accidental or ignorant password policies from the past, not deliberate attempts to make their customers trip up (unless someone knows better). As for the asking birthday for security reasons, relic from the past, getting more useless as time goes by. With so many websites asking for that information, and then they get hacked, sold or leaked. Yes, this said the completely obvious, but it still amazes me that any organisation that I have a financial relationship with asks that for identification over the phone, usually my address as well, but that is almost as public.
rapht 5y ago
Don't get me started on online bank security. Here in France, most banks have decided that security is best achieved by: - authenticating using a 'client number' (different from your 'account number', sent to you once by a physical mail you lost long ago) combined with a 4-to-6 digit (numeric-only) passcode that you have to input on a virtual keyboard - confirming web-initiated transactions via their app on your phone... but when it's app-initiated, well, you don't have to confirm anything other than just retype your passcode - in the end, introducing some awfully long delays between some actions e.g. creating a new beneficiary and being able to send money to her... because 'it's for your own protection that we degrade your client experience' This just bugs me.

stjohnswarts 5y ago

Yeah my bank does this. I've been meaning to call around and find a credit union that has 2FA and doesn't require this garbage. I changed my questions to a randomly generated password and put it in my password manager.

jliptzin 5y ago

Citibank is particularly egregious. 8 character MAXIMUM length, lots of special characters not permitted while requiring numbers and letters, forced password changing every few months, I absolutely hate it.

ptk 5y ago
Are you speaking as an employee or a customer? I just checked my password db for a few Citibank accounts and all of them were far longer than 8 characters.
- jliptzin 5y ago
  For my CitiBusiness account, not my personal accounts

kibwen 5y ago

Treating security questions like passwords and saving them in your password manager is correct, but make sure that your fake answers aren't autogenerated nonsense like ":s^Twd.J;3hzg=Q~". Many password reset flows involve communicating a security question over the phone, and it's easy enough for an attacker to guess "oh, it's just a bunch of random characters lol" and for the phone rep to just laugh and shrug their shoulders and let the person in. Make sure it's a sentence that makes sense (I would even avoid non-sequitur passphrases such as those generated by diceware), while also making sure that it has no relationship whatsoever to the question.

js2 5y ago
openssl rand -hex 8 | sed 's/..../&-/g;s/-$//' Or if you like upper-case letters: openssl rand -hex 8 | sed 's/..../&-/g;s/-$//;y/abcdef/ABCDEF/
- exolymph 5y ago
  This would still parse as "random letters and numbers" to your typical support agent, no?
  - js2 5y ago
    Maybe, but it's close to what I use. It's a limited character set and more or less looks like a credit-card which people are used to seeing. It's either that or pick a random dictionary word.
- deleted 5y ago
  [deleted]
time0ut 5y ago
My password generator can make pronounceable nonsense words. It has worked ok so far. Some of them are embarrassing though.
- fragmede 5y ago
  My password generator (or just do it manually) can generate word passwords like correct-horse-battery-staple using real words, which is probably a bit easier to read over the phone.
  - Symbiote 5y ago
    grep --perl-regexp '^[a-z]{4,7}$' /usr/share/dict/words | \ shuf -n 5 | tr '\n' ' ' Although maybe just 2 or 3 words would be best for avoiding a support agent skipping the question. bless clench moraine

matheusmoreira 5y ago

Yeah, my bank does that too. Asks for my birthday for "security" reasons. They also kill their website's usability by forbidding physical keyboards and forcing users to use a virtual keyboard with randomized key layouts in order to type passwords in a feeble attempt to defeat keyloggers. Some banks even make it extra annoying by generating ambiguous keys like "1 or 7" or "2 or 3". The saddest thing is banks can't be too secure. If they were, then they would be too hard for normal people to use and they would get locked out of their funds.

kortex 5y ago
I imagine it also disables autofill from password managers (since it's not actually a form field)? I would literally close out my account in that very moment if my bank did that. Not only because that's horribly inconvenient and I would never put up with it, but it also shows they have no idea what are sane security measures or not.
- matheusmoreira 5y ago
  > I imagine it also disables autofill from password managers (since it's not actually a form field)? Yes. They also force users to install literal malware into their computers masquerading as a "security module". Not only is it invasive, it slows down everything to a crawl. I tried to reverse engineer one such module and caught it intercepting every single network connection. It also used to force install itself into browsers as an extension, no doubt in order to intercept data. > I would literally close out my account in that very moment if my bank did that. That's exactly what I did. Chose a smaller bank that somehow didn't use this malware. The least bad option.
pitay 5y ago
My bank used to have a virtual keypad, they now have a normal password field. So they actually saw reason. I think there is reason to be optimistic about bank password security getting better; what is known to be good password policies and interfaces are getting more widespread. It may take some time, but it should get better because it is accidental or ignorant password policies from the past, not deliberate attempts to make their customers trip up (unless someone knows better). As for the asking birthday for security reasons, relic from the past, getting more useless as time goes by. With so many websites asking for that information, and then they get hacked, sold or leaked. Yes, this said the completely obvious, but it still amazes me that any organisation that I have a financial relationship with asks that for identification over the phone, usually my address as well, but that is almost as public.

rapht 5y ago

Don't get me started on online bank security. Here in France, most banks have decided that security is best achieved by: - authenticating using a 'client number' (different from your 'account number', sent to you once by a physical mail you lost long ago) combined with a 4-to-6 digit (numeric-only) passcode that you have to input on a virtual keyboard - confirming web-initiated transactions via their app on your phone... but when it's app-initiated, well, you don't have to confirm anything other than just retype your passcode - in the end, introducing some awfully long delays between some actions e.g. creating a new beneficiary and being able to send money to her... because 'it's for your own protection that we degrade your client experience' This just bugs me.