6 ms·

> I have dealt with banking environment when they required SSL with at least 1-year validity on the callback API URL Why are (some) banks always completely clu

by lol768 2y ago

> I have dealt with banking environment when they required SSL with at least 1-year validity on the callback API URL Why are (some) banks always completely clueless about these things? Validating ownership of the domain more often (and with an entirely automated provisioning set-up that has no human weak links) can only be a good thing. Perhaps the banking sector will finally enter the 21st century in another ten years?

Veen 2y ago
The problem is more likely one of regulation than technical knowledge. Banks hire very smart people who know that a lot of what they do is bullshit, but they're paid to comply with banking and security regulations that lag a long way behind technical advances. Banks are also inherently conservative in their technical choices, and for good reason.
karel-3d 2y ago
The banking sector usually goes with "checkbox security". They have these really, really long lists what all needs to be secured and how. Some of it is reasonable, some of it is bonkers, there is way too much of that stuff, and it overall increases the price of any solution 10x at least. But OTOH I can hardly blame them, failures can be catastrophic there, as they deal with real money directly and can be held liable for failures. So they don't really care about security, and more about covering their asses.
- dspillett 2y ago
  > some of it is bonkers Some of it is truly bonkers and never was good practise, but much of the irritating stuff is simply out-of-date advice. The banks tend to be very slow to change unless something happens that affects (or directly threatens to affect) the bottom line, or puts them in the news unfavourably. Of course some of it is bonkers, like HSBC and FirstDirect changing the auth for my personal accounts from “up to 9 case-sensitive alpha-numeric characters” (already considered bad practise for some years) to “6 digits”, and assuring me that this is just as secure as before…
  - dizhn 2y ago
    That sounds like "we were truncating your id and pass before anyway".
    - dspillett 2y ago
      I don't think so, because it would also imply they were also throwing away anything non-numeric, and I really hope nothing that stupid was going on. When the change happened everyone had to establish a new password. I read it as “we have been asked to integrate an ancient system that we can't update (or more honestly in many cases: can't get the higher-ups to agree to pay to update), so are bringing out other systems down to the lowest common denominator”. That sort of thing happens too often when two organisations (or departments within one) that have different procedures, merge or otherwise start sharing resources they didn't previously.
- BrandoElFollito 2y ago
  I won't go into the idiocies banks implement. They usually have to because totally incompetent people tell them they have to. One of the practices was pathetic to the point of being funny: you had to input specific characters of your password (2nd, 4th, 6th, etc - this was changing at each login) AND there was a short timeout. My children probably learned a few new words when I was logging in.
  - jjeaff 2y ago
    I suppose the purpose of that was to signal to hackers that they ARE in fact storing all passwords in plaintext?
    - BrandoElFollito 2y ago
      It is very likely, yes. After a year or so of this practice (people were writing down their password with digits under the letters to quickly match the request) the bank said that they now propose two "secure login forms" - the older one and a new, normal one. Some time later they silently removed the first one.
  - Apfel 2y ago
    Tsb bank in the UK still do exactly this

by lol768 2y ago

Veen 2y ago

The problem is more likely one of regulation than technical knowledge. Banks hire very smart people who know that a lot of what they do is bullshit, but they're paid to comply with banking and security regulations that lag a long way behind technical advances. Banks are also inherently conservative in their technical choices, and for good reason.

karel-3d 2y ago

The banking sector usually goes with "checkbox security". They have these really, really long lists what all needs to be secured and how. Some of it is reasonable, some of it is bonkers, there is way too much of that stuff, and it overall increases the price of any solution 10x at least. But OTOH I can hardly blame them, failures can be catastrophic there, as they deal with real money directly and can be held liable for failures. So they don't really care about security, and more about covering their asses.

dspillett 2y ago
> some of it is bonkers Some of it is truly bonkers and never was good practise, but much of the irritating stuff is simply out-of-date advice. The banks tend to be very slow to change unless something happens that affects (or directly threatens to affect) the bottom line, or puts them in the news unfavourably. Of course some of it is bonkers, like HSBC and FirstDirect changing the auth for my personal accounts from “up to 9 case-sensitive alpha-numeric characters” (already considered bad practise for some years) to “6 digits”, and assuring me that this is just as secure as before…
- dizhn 2y ago
  That sounds like "we were truncating your id and pass before anyway".
  - dspillett 2y ago
    I don't think so, because it would also imply they were also throwing away anything non-numeric, and I really hope nothing that stupid was going on. When the change happened everyone had to establish a new password. I read it as “we have been asked to integrate an ancient system that we can't update (or more honestly in many cases: can't get the higher-ups to agree to pay to update), so are bringing out other systems down to the lowest common denominator”. That sort of thing happens too often when two organisations (or departments within one) that have different procedures, merge or otherwise start sharing resources they didn't previously.
BrandoElFollito 2y ago
I won't go into the idiocies banks implement. They usually have to because totally incompetent people tell them they have to. One of the practices was pathetic to the point of being funny: you had to input specific characters of your password (2nd, 4th, 6th, etc - this was changing at each login) AND there was a short timeout. My children probably learned a few new words when I was logging in.
- jjeaff 2y ago
  I suppose the purpose of that was to signal to hackers that they ARE in fact storing all passwords in plaintext?
  - BrandoElFollito 2y ago
    It is very likely, yes. After a year or so of this practice (people were writing down their password with digits under the letters to quickly match the request) the bank said that they now propose two "secure login forms" - the older one and a new, normal one. Some time later they silently removed the first one.
- Apfel 2y ago
  Tsb bank in the UK still do exactly this