I agree. If anything, reading this analysis would make me feel /more/ comfortable about the security of this bank's software, not less It seems that they did

I agree. If anything, reading this analysis would make me feel /more/ comfortable about the security of this bank's software, not less It seems that they did pretty much everything right, if a bit strangely, in some cases. TOTP and co. require a private key, just like all crypto. If you have that private key, bad things happen. This is not exactly news at 11.