3 ms·

> Corporate answering like you're some kind of clueless idiot is the worst. I regularly deal with UK banks, many of whose 2nd step auth is to send an SMS to yo

> Corporate answering like you're some kind of clueless idiot is the worst. I regularly deal with UK banks, many of whose 2nd step auth is to send an SMS to your phone. I regularly ask for other ways of doing the 2nd step such as TOTP or even hardware. I get similar responses back that what they have is secure. It is not secure. The banking sector's regulations consider it an acceptable 2nd step, which they conflate with being secure. So I regularly get condescending responses about it.

dspillett 4y ago
Access to my HSBC accounts is via a digit-only pin and SMS (to the same phone the app is running on) for the second factor. The pin used to be max 9 characters alpha-numeric, which is still bad, and when they changed it (earlier this year) to be shorter and numeric only all the communications were are great pains to assure me that things are just as secure as before… (Which by some definitions may be true: it went from not secure enough to not secure enough). Luckily for me the only significant thing I have with them is a mortgage that will be paid off in January at which point I'll be closing all accounts I have with them. In the meantime I'll keep pushing about it in every relevant thread in the hope someone high enough up there gets wind and is embarrassed enough to make change happen. FirstDirect is very similar, though those accounts at least still have 9-character case-sensitive alphanumeric passwords not just a numeric-only pin.
- philsnow 4y ago
  When I had HSBC accounts, their security was laughable but in the other direction: IIRC, in addition to just the plain password which you had to type by hunt-and-peck on an onscreen keyboard, you also had to make up some "security phrase" which they would make you type a few letters from, like the 1st, 3rd, and 24th letters. Maybe their new security approach is a response to that.
alex_duf 4y ago
In France for some strange reason, banks are forced to have a stupid 6 to 8 number as a password. Literally [0-9]{6}. They have "secured" it by forcing each bank to implement their own keypad, that randomises the order of keys in order to make scripting much harder. It makes no sense, my password manager freaks out about it every time. There is TFA (thank goodness), but still, it feels so stupidly unsecured. I wonder why, and who to complain to, if anyone has any info on that I'll take it
- vbarrielle 4y ago
  I know at least one french bank which accepts regular strings as passwords, so it may not be a legal requirement. Which makes it confusing why it's so widespread...
izacus 4y ago
Don't worry, they'll "fix" it as most of continental EU banks did: by forcing you to use their app which will break on every OS update (when Android 13 rolled out, one of the banks had their app broken for months and their users couldn't authorize any payments). You'll also be forced to use the mobile phone of the brand they deem personally "secure". Don't even think about any kind of privacy respecting phones like GrapheneOS. But you'll be secure. At least by definition of their "security consultants". And if your phone breaks? Well, good luck buying a new one because the payment confirmation app is on that same broken phone.

dspillett 4y ago

Access to my HSBC accounts is via a digit-only pin and SMS (to the same phone the app is running on) for the second factor. The pin used to be max 9 characters alpha-numeric, which is still bad, and when they changed it (earlier this year) to be shorter and numeric only all the communications were are great pains to assure me that things are just as secure as before… (Which by some definitions may be true: it went from not secure enough to not secure enough). Luckily for me the only significant thing I have with them is a mortgage that will be paid off in January at which point I'll be closing all accounts I have with them. In the meantime I'll keep pushing about it in every relevant thread in the hope someone high enough up there gets wind and is embarrassed enough to make change happen. FirstDirect is very similar, though those accounts at least still have 9-character case-sensitive alphanumeric passwords not just a numeric-only pin.

philsnow 4y ago
When I had HSBC accounts, their security was laughable but in the other direction: IIRC, in addition to just the plain password which you had to type by hunt-and-peck on an onscreen keyboard, you also had to make up some "security phrase" which they would make you type a few letters from, like the 1st, 3rd, and 24th letters. Maybe their new security approach is a response to that.

alex_duf 4y ago

In France for some strange reason, banks are forced to have a stupid 6 to 8 number as a password. Literally [0-9]{6}. They have "secured" it by forcing each bank to implement their own keypad, that randomises the order of keys in order to make scripting much harder. It makes no sense, my password manager freaks out about it every time. There is TFA (thank goodness), but still, it feels so stupidly unsecured. I wonder why, and who to complain to, if anyone has any info on that I'll take it

vbarrielle 4y ago
I know at least one french bank which accepts regular strings as passwords, so it may not be a legal requirement. Which makes it confusing why it's so widespread...

izacus 4y ago

Don't worry, they'll "fix" it as most of continental EU banks did: by forcing you to use their app which will break on every OS update (when Android 13 rolled out, one of the banks had their app broken for months and their users couldn't authorize any payments). You'll also be forced to use the mobile phone of the brand they deem personally "secure". Don't even think about any kind of privacy respecting phones like GrapheneOS. But you'll be secure. At least by definition of their "security consultants". And if your phone breaks? Well, good luck buying a new one because the payment confirmation app is on that same broken phone.