6 ms·

The entire "account recovery" concept just reeks of ad-hoc solutions piled on top of ad-hoc solutions. They're designed primarily so that legit customers who ca

by B-Con 14y ago

The entire "account recovery" concept just reeks of ad-hoc solutions piled on top of ad-hoc solutions. They're designed primarily so that legit customers who can't get into their accounts suffer as little inconvenience as possible, and they try to toss some security in on the side.

chimeracoder 14y ago
My favorite is bank accounts: 'Tell us your account number, as well the amount of a recent transaction on the account'. Oh, so you gave me a personal check? Great, let me go deposit it, so that's a transaction that I know about. And I already have your account number (and routing information) from the check itself. This isn't just to be able to drain all funds from the checking account (for which the numbers on the check alone are sufficient) but to reset the passwords on the account, which usually gives you access to any linked accounts as well.
- amouat 14y ago
  Yeah, but at least it's a bit more trackable - they know they gave you a check.
  - cyber 14y ago
    And yet they were so happy that someone off of craigslist was willing to accept a check. (private browsing, throwaway email, tor, check cashing place, etc.)
- deleted 14y ago
  [deleted]
- zxoq 14y ago
  My bank is a lot more careful then this. I actually called them a few days ago to get a password, and they asked: * SSN? * Full name? * How long have you been with the bank? * How many accounts do you have? * Do you have a business account? * How many business accounts? * What's the name of the business? * Have you set up auto-debit? * Have you set up electronic-debit? * To what companies? * What was your last charge on your credit card? * Do you have any monthly transfers set up? * For what amounts? * Do you have any loans? * Do you own any investment funds? * Which? * Have you reset the password before? * <My security question>? * How many two-factor auth thingies do you have? * Serial number on your two-factor auth thingy? * Model of the above? Are the questions I recall. So at least not every bank is careless enough to only require you to name a recent transaction.
  - Tyrannosaurs 14y ago
    I've had this recently. The banks seem to have worked out that they have access to a reasonable amount of information that they can use it in this way. The answers weren't easily guessable and there was a threshold so you didn't need to get everything right which allows them to make the questions a little trickier. The system wasn't perfect - if you broke into my house and got my papers you could probably get past it - but it was a million times better than asking where I went to school.
  - chimeracoder 14y ago
    What bank? Seriously, I will consider switching. Including business accounts and brokerage accounts (which are often handled separately with different security processes), I've had numerous accounts with many different providers, and never had anything close to that level of security.

by B-Con 14y ago

chimeracoder 14y ago

My favorite is bank accounts: 'Tell us your account number, as well the amount of a recent transaction on the account'. Oh, so you gave me a personal check? Great, let me go deposit it, so that's a transaction that I know about. And I already have your account number (and routing information) from the check itself. This isn't just to be able to drain all funds from the checking account (for which the numbers on the check alone are sufficient) but to reset the passwords on the account, which usually gives you access to any linked accounts as well.

amouat 14y ago
Yeah, but at least it's a bit more trackable - they know they gave you a check.
- cyber 14y ago
  And yet they were so happy that someone off of craigslist was willing to accept a check. (private browsing, throwaway email, tor, check cashing place, etc.)
deleted 14y ago
[deleted]
zxoq 14y ago
My bank is a lot more careful then this. I actually called them a few days ago to get a password, and they asked: * SSN? * Full name? * How long have you been with the bank? * How many accounts do you have? * Do you have a business account? * How many business accounts? * What's the name of the business? * Have you set up auto-debit? * Have you set up electronic-debit? * To what companies? * What was your last charge on your credit card? * Do you have any monthly transfers set up? * For what amounts? * Do you have any loans? * Do you own any investment funds? * Which? * Have you reset the password before? * <My security question>? * How many two-factor auth thingies do you have? * Serial number on your two-factor auth thingy? * Model of the above? Are the questions I recall. So at least not every bank is careless enough to only require you to name a recent transaction.
- Tyrannosaurs 14y ago
  I've had this recently. The banks seem to have worked out that they have access to a reasonable amount of information that they can use it in this way. The answers weren't easily guessable and there was a threshold so you didn't need to get everything right which allows them to make the questions a little trickier. The system wasn't perfect - if you broke into my house and got my papers you could probably get past it - but it was a million times better than asking where I went to school.
- chimeracoder 14y ago
  What bank? Seriously, I will consider switching. Including business accounts and brokerage accounts (which are often handled separately with different security processes), I've had numerous accounts with many different providers, and never had anything close to that level of security.