4 ms·

My bank requires 8 to 10 characters, [a-z]|[A-Z]|[0-9] only. They also require you to know something easily researched from facebook (elementary school, mother

by lytfyre 14y ago

My bank requires 8 to 10 characters, [a-z]|[A-Z]|[0-9] only. They also require you to know something easily researched from facebook (elementary school, mother's maiden name, etc.) when you use a new machine. That they refer to this as two factor authentication makes me question their ability to do simple addition, something I consider a fairly important skill for a bank.

jackpirate 14y ago
something I consider a fairly important skill for a bank but not important enough to switch apparently
- icebraining 14y ago
  You're assuming the others available to him are any better.
edoloughlin 14y ago
> They also require you to know something easily researched from facebook (elementary school, mother's maiden name, etc.) I'll never understand why someone would provide this information to Facebook. My friends already know the details of my life relevant to our relationship.
- shabble 14y ago
  maybe because they're part of a "$foo High School class of '99" group/page/whatever with some friends, or perhaps both parents and grandparents are linked as friends, making it pretty easy to figure out mother's pre-marriage surname? It's not just the explicit facts you provide, a significant part of the deeper value is from the linkages between them.
dgordon 14y ago
Not that it excuses this so-called security, but for the insecurity question, you could just lie. Only problem is, then you have to remember your lies.
dredmorbius 14y ago
That was another point I meant to raise. Even if your password policy and weak-password checks are sane, if your account recovery procedure is weak, there are still planet-sized holes in your security perimeter. And for any large system (say, Facebook, with, oh, nearly a billion accounts), user support requests (many of which are access related) are a huge cost. It doesn't take many of these to eat through $2-$5/account/year value they're seeing.

by lytfyre 14y ago

jackpirate 14y ago

something I consider a fairly important skill for a bank but not important enough to switch apparently

icebraining 14y ago
You're assuming the others available to him are any better.

edoloughlin 14y ago

> They also require you to know something easily researched from facebook (elementary school, mother's maiden name, etc.) I'll never understand why someone would provide this information to Facebook. My friends already know the details of my life relevant to our relationship.

shabble 14y ago
maybe because they're part of a "$foo High School class of '99" group/page/whatever with some friends, or perhaps both parents and grandparents are linked as friends, making it pretty easy to figure out mother's pre-marriage surname? It's not just the explicit facts you provide, a significant part of the deeper value is from the linkages between them.

dgordon 14y ago

Not that it excuses this so-called security, but for the insecurity question, you could just lie. Only problem is, then you have to remember your lies.

dredmorbius 14y ago

That was another point I meant to raise. Even if your password policy and weak-password checks are sane, if your account recovery procedure is weak, there are still planet-sized holes in your security perimeter. And for any large system (say, Facebook, with, oh, nearly a billion accounts), user support requests (many of which are access related) are a huge cost. It doesn't take many of these to eat through $2-$5/account/year value they're seeing.