3 ms·
Worst I've seen by far for getting into a desktop banking website recently, it felt like a parody: 1. On desktop: Enter username and answer to a random memorab
by seanwilson 5y ago
Worst I've seen by far for getting into a desktop banking website recently, it felt like a parody:
1. On desktop: Enter username and answer to a random memorable question like "your first pet" (password manager will probably fail to autofill this). You're then prompted for a "mobile security code".
2. On mobile app: Enter username + different password. Need to scroll, tap 7 items and then enter a password to get a mobile code you then have to type into the desktop app.
Getting the mobile security code logs you out of the mobile app and logging into the mobile app will log you out of the desktop app.
It's like they didn't do any user testing and think that more steps = better security.
Lots of UK banks also ask for random parts of your password only e.g. "enter the 2nd, 10th and 5th character from your password" which is super tedious to do correctly because you can't use muscle memory or autofill. This is to defeat key loggers? Isn't that what 2FA would do? You'd think banks would be clued up on this.
- plazmatic 5y agoIs this known as the Rube Goldberg Machine authentication process?
- wildrhythms 5y agoOne time I signed up on a site with 'Sign in with Google'. Months later, I wanted to delete my account, but the deletion process required I enter my account's password, which obviously I was never prompted to set up. The site wouldn't let me do a 'Forgot password' to set a password, so the account was impossible to delete.
- perryizgr8 5y agoIt's easy! Just delete your google account, it will automatically invalidate any credential tokens given out to the third party site.
- gwbas1c 5y agoI'd change banks!
- seanwilson 5y agoYep, agree with that. UK banks don't usually advertise their log-in UX though so it's a pain being surprised by this and having to switch after going through the long sign up process (usually involves receiving letters by post and multiple sign-up steps over a week).