5 ms·

I am similarly annoyed by Bank of America. They allow you to enroll a Yubikey for login, making it seem like they have a high level of security. But then on

I am similarly annoyed by Bank of America. They allow you to enroll a Yubikey for login, making it seem like they have a high level of security. But then on the login screen they moronically offer a one click bypass of it, asking if you want to login by SMS instead. What's the fucking point of a Yubikey then!?

noahtallen 4y ago
Yeah… are there any banks that have actually good security? Seems like they’re all surprisingly terribly out of date. Similarly, Amazon does not offer a way to remove SMS from your account once it’s added, even after setting up another OTP method.
- criddell 4y ago
  From the bank's point of view, it's good enough security. My wife and I had money stolen from our Wells Fargo checking account and I had a bunch of questions for them. Somebody from higher up eventually called me and when I got to the point about asking why the password was limited to 12 characters (they should be storing a hash and not the password) she told me to stop worrying about it because I'm not responsible for fraud. > Amazon does not offer a way to remove SMS from your account once it’s added Even if you no longer have that phone?
  - genocidicbunny 4y ago
    > she told me to stop worrying about it because I'm not responsible for fraud. I'd start asking to be reimbursed for the time I have to waste on dealing with the fraud then.
thayne 4y ago
For chase the only option for 2FA is SMS.
supernova87a 4y ago
And even the login problems aside, I'm even more galled by the fact that our system of bank checking accounts allows anyone to fat finger mistakenly debit (ACH) money from your account, and it's up to you to discover and get that reversed. I know all the historical reasons, etc. but this is still ridiculous to me. All the security in the world, and I still have to worry whether my brokerage funds are missing some each month.
brnt 4y ago
I wish there were banks in my country supporting U2F. Or my nations national ID. The most sensitive things seems to have the least amount of security.

noahtallen 4y ago

Yeah… are there any banks that have actually good security? Seems like they’re all surprisingly terribly out of date. Similarly, Amazon does not offer a way to remove SMS from your account once it’s added, even after setting up another OTP method.

criddell 4y ago
From the bank's point of view, it's good enough security. My wife and I had money stolen from our Wells Fargo checking account and I had a bunch of questions for them. Somebody from higher up eventually called me and when I got to the point about asking why the password was limited to 12 characters (they should be storing a hash and not the password) she told me to stop worrying about it because I'm not responsible for fraud. > Amazon does not offer a way to remove SMS from your account once it’s added Even if you no longer have that phone?
- genocidicbunny 4y ago
  > she told me to stop worrying about it because I'm not responsible for fraud. I'd start asking to be reimbursed for the time I have to waste on dealing with the fraud then.

thayne 4y ago

For chase the only option for 2FA is SMS.

supernova87a 4y ago

And even the login problems aside, I'm even more galled by the fact that our system of bank checking accounts allows anyone to fat finger mistakenly debit (ACH) money from your account, and it's up to you to discover and get that reversed. I know all the historical reasons, etc. but this is still ridiculous to me. All the security in the world, and I still have to worry whether my brokerage funds are missing some each month.

brnt 4y ago

I wish there were banks in my country supporting U2F. Or my nations national ID. The most sensitive things seems to have the least amount of security.