10 ms·
Schwab password policies and two factor authentication
- tootie 12y agoWe need some sort of interenet security reformation. This is even more ridiculous than when the Chase mobile banking app for Android didn't check if SSL certs were authentic before sending credentials.
- mariusz331 12y agoI've been using Schwab for almost 5 years and haven't noticed the password limitation until about 2 years ago. My password is pretty lengthy, so when I mistyped the last letter and pressed enter, I expected an error message. Instead, Schwab logged me in. I investigated a bit and ended up contacting Schwab about the "vulnerability". I remember someone quite high up responding saying they were aware of the length limit but that they lock you out after 3 failed password attempts. I didn't validate the claim, but I felt content and moved on.
- Glyptodon 12y agoI had a similar experience with Southwest Airlines. They limit their passwords to something absurdly short, and it turned out I'd never noticed - I always typed what I thought was the password, but it was actually ignoring all of it but the first 8 characters even though I typed more in every time. I don't think it's quite as bad as Schwab, but I don't understand why doing passwords so wrong is so widespread.
- bjorn2404 12y agoIt's the same for Wells Fargo. I can type random characters after the password and still login.
- bhartzer 12y agoThanks for posting, I've passed this on to my contact at Schwab to see if it can get fixed properly ;)
- colinbartlett 12y agoIt appears a lot of people have already warned Schwab about this. Sadly, I expect it will change only if there was some embarrassing large scale attack that is subsequently publicized.
- thrownaway2424 12y agoHow would such large scale attack be perpetrated? The worst you could do would be to lock out a lot of accounts.
- cddotdotslash 12y agoIf someone managed to steal a database of credentials from Schwab, they could possibly decrypt the passwords (all these limitations clearly point to them not hashing properly). If someone stole a database from a provider that implements passwords correctly, the best they could do is get some low-hanging fruit passwords.
- nhstanley 12y agoThis has been a problem for years that they refuse to fix. The legacy password thing (Strike one) is bullshit, they could just force everyone to update their passwords when they implement a properly designed system. I would be even more disheartened if customer complaints and an article in Ars can't get this fixed, but someone "passing it on to a contact" could. It's disgusting that this is how they've handled it. I minimize how much money I keep with them and will be closing the account when I get back to the States.
- bhartzer 12y agoI understand your frustration, but let's see how 'passing it on to a contact' will (or will not) work in this case.
- markcerqueira 12y agoQuite shameful. Fortunately, I only use Schwab because of their awesome checking account that covers ATM fees. Definitely won't put more of my assets in there until they get their act together. I may be wrong, but I think user IDs can be longer than 8 characters too which makes this all even worse. LinkedIn did something similar with having to append your auth token to the end of your password, but they actually checked the token AFAIK.
- mariusz331 12y agoAre there benefits to append the token to the end of the password over adding a field for it in the form?
- thesimon 12y agoConvenience for the user (no need to move to a different field) and UI advantages (no need for an third field which might make the form look complicated and confuse users who don't have 2FA activated. Not saying that this is a good idea, but there are some benefits for appending the token.
- jeremyt 12y agoI might buy it if two factor activation wasn't a one time operation. As it stands, there's no need to confuse existing users. You just need a separate pathway to activate the token. THEN you just ask for the token as a step two in the login process. That's actually how Schwab handles things right now.
- markcerqueira 12y agoFor some shitty services, like PayPal that don't give you a long-lived auth token, it is an every-time process. :| As expected, Schwab isn't the only perpetrator of bad two-factor auth. I think PayPal still DOES NOT support two-factor auth on their mobile clients. Shameless plug of my blog posts about Paypal's terrible two factor auth: http://mark.gg/2014/10/22/paypal-and-delusions-of-grandeur/ http://mark.gg/2014/10/22/paypal-and-delusions-of-grandeur/ http://mark.gg/2014/06/04/kicking-the-tires-with-paypal/ http://mark.gg/2014/06/04/kicking-the-tires-with-paypal/
- michaelfeathers 12y agoBanks aren't technology companies. Someday a technology company will become a bank.
- personZ 12y agohttp://www.businessinsider.com/bank-it-spending-2012-12 http://www.businessinsider.com/bank-it-spending-2012-12 The banking system functions largely on the choice, application and integration of technology, and banking is more of a technology business than just about any other. And let's be fair here - Schwab is not a bank, and even among investment firms is an outlier with the noted bad practices.
- michaelfeathers 12y ago> banking is more of a technology business than just about any other. They don't behave like Google or Facebook. Their DNA is not technical.
- personZ 12y agoYet they behave like Microsoft, or IBM, or HP. And those are unquestionably technology businesses.
- ladelfa 12y agoHow about the part of Schwab that's literally called "Charles Schwab Bank"?
- reustle 12y agoIsn't that what Simple advertised themselves as? http://simple.com http://simple.com
- nkantar 12y agoI created an account a while ago, added the requisite $1, and promptly never used it again, largely because they didn't offer savings accounts (and still don't seem to). Do you have any informed opinions on Simple?
- modeless 12y agoI filed a support ticket about the password length. They told me it was due to "government standards" and they would reevaluate after a new standard came out. I didn't inquire further into this obvious BS. They provide a good service otherwise so it's strange that they have this blind spot.
- ryan-c 12y agoThe modern government standard for classified systems is 15 characters minimum.
- jcrawfordor 12y agoMy guess would be that by "government standards" they were referring to PCI-DSS (actually an industry group standard), which in the current version requires passwords of at least 7 characters and with at least letters and numbers (PCI-DSS v3.0 8.2.3). ...However, the standard explicitly permits any other password requirement of the same or greater entropy. ...However, these requirements do not apply to consumer accounts at all (!). As far as I can tell, PCI-DSS actually has no requirements whatsoever for safeguarding of consumer user accounts. The more you know, the more you worry.
- spac 12y agoI did report this a while ago to Schwab both over the phone and on Twitter and I have been equally ignores. Thanks for writing a blog post about it. Edit: forgot to mention that the passwords are case insensitive!!!!!!
- spac 12y agoHere's the tweet https://twitter.com/stefpac/status/455132477724852224 https://twitter.com/stefpac/status/455132477724852224
- cdolan 12y agoYou are factually incorrect that the passwords are case insensitive.
- spac 12y agoFair enough: Schwab's login mechanism ignores the case of the passwords.
- AjithAntony 12y agoVerified, mine is case-insensitive. If phone-keypad-password-entry is a requirement, then that makes sense.
- cdolan 12y agoIm confused, are you verifying that the passwords are or are not case sensitive? Mine is certainly case sensitive (watch me get hacked now, 8 characers, one is capital!)
- AjithAntony 12y agomine is case-insensitive It is possible there are more than one schwab interfaces that behave differently. I have two entry points. One for just 401k (https://www.schwabplan.com https://www.schwabplan.com). That one has long case-sensitive passwords. The brokerage account(https://client.schwab.com https://client.schwab.com) is short and case-insentive
- yalogin 12y agoI have called and complained many times about their password policies. They let you choose a random user id, as in, change the user id whenever you want. I bet you the security guys over at Schwab are using that as a reason to not improve password options. I can see the argument being - "The idiotic password limitations are not a big deal because of the random userids".
- benguild 12y agoApparently they insure you against someone breaking into your account, but this is clearly the case of a bunch of old boys who don't understand tech being in charge.
- et2o 12y agoI recently filled out a support ticket concerning password policies too, after opening an account. I received a rather absurd reply and decided not to transfer any of my money to them.
- userbinator 12y agoTo activate my newly received token, I was instructed to go to the homepage and append the six digit token code onto the end of my password during a login attempt. This sounds like a symptom of the multilayered bureaucracy that often goes on in banks and similar institutions - a change to the UI to add something as simple as an extra field for the token code, and the changes required to hook it up to the backend, might have been accompanied by so much "enterprisey" management red-tape cruft (specification writing, approval documents, approval meetings, meetings for scheduling meetings - I wish I was joking, etc.) that it made the programmers find creative ways around the system. At the least, if I were forced to concatenate fields, I'd use a separator that couldn't occur in either one, like a comma or something else that their password policy didn't allow... but then again, I wouldn't be surprised if something else in their system would reject that.
- elahd 12y agoI complained to Schwab about their password policies numerous times over the 3 years I was a bank/brokerage customer. A few months ago I finally moved my accounts to TD. Schwab's standard response was 1) to assure me that they had "intelligent" fraud monitoring systems on their backend and 2) to offer me a hard token, which would have been a pain and may have caused issues with Mint.
- cddotdotslash 12y agoMy response to fraud monitoring: "I have an alarm on my car, but I still lock the doors."
- flavor8 12y ago> A few months ago I finally moved my accounts to TD. You'll be back to Schwab before you know it. TD are beyond awful. Schwab have pretty much the best customer service going.
- polarix 12y agoYeah, this flow is completely nuts. After setting up 2fac, in general, though, the thing to do is probably test that you can't log in without it.
- deet 12y agoNot that this is an excuse, but keep in mind that Schwab probably has had the mentality that a compromise of a user's online account, while bad, is not the end of the world. They have been frustratingly slow in implementing features like linking external bank accounts using trial deposits instead of mailing them a voided check from the external account. Their slowness to adopt these new features has meant that if you got access to the online account, there wasn't much you could do as a third party that moved money out of the already linked accounts of the victim. You could cause headaches or buy/sell securities but not access the money easily. And if you did link an account or add a biller the victim would get an email. Things have probably changed recently since I think you can link external accounts now, and there's probably a way to send yourself a check as a bill payment. Totally not an excuse though. Note: I was fooled by the password length as well. Sometimes I would hit what I thought was the wrong last few letters on my phone keyboard yet the password would still work somehow. Turns out you can just type the first eight and be done.
- PhantomGremlin 12y ago> Schwab probably has had the mentality that a compromise of a user's online account, while bad, is not the end of the world Hmmm. Where have we heard that before? Yes, Sony!!! There's probably a better link but here is the first one I found:[1] Back in 2007, Jason Spaltro, then the executive director of information security at Sony Pictures Entertainment, was shockingly cavalier about security in an interview with CIO Magazine. He said it was a “valid business decision to accept the risk” of a security breach, and that he wouldn’t invest $10 million to avoid a possible $1 million loss. Has anyone heard recently about how that's working out for them? :) [1] http://fusion.net/story/31469/sony-pictures-hack-was-a-long-time-coming-say-former-employees/ http://fusion.net/story/31469/sony-pictures-hack-was-a-long-...
- overgard 12y agoSome of their competitors are just as bad. I remember I started to sign up for a TD Ameritrade account a few years ago, but when the password "requirements" came up (which were very similar), it was clear that they were probably storing passwords as plaintext, so I stopped. Then I got phone calls from them asking why I hadn't finished, so I had to explain to a person that clearly wasn't technical (not his fault, of course), that his company had no idea what they were doing security wise. Maybe they finally fixed it though. I can only hope.
- Flott 12y ago8 digits password... It sound like DES encryption stored directly in the database. (This is pure speculation of course) This alone is a huge red flag. Adding the fact that the 2 factor auth. is broken is not a good news.
- psykovsky 12y agoHow about the case insensitivity on the passwords? How does that fit with DES encryption, or any kind of encryption at all?
- MichaelGG 12y agoUser friendliness. FB did something similar where they'd store several versions of your password. That way they could tell if you had caps lock on or other problems.
- psykovsky 12y agoYou really used facebook as a best practices example? Where is the source code of facebook's function that deals with case insensitive passwords? How can you be sure such source code is actually being used in production? It's as good as plaintext without any of those assurances...
- ryan-c 12y agoI think you mean DES based crypt and not DES encryption.
- Flott 12y agoYes that's what I meant, thanks.
- timeal 12y agoThis story needs to be upvoted 1000 times. Why are financial institution so _bad_ at password policies?
- feld 12y agoProbably mainframes that they can't get rid of, or systems emulating / used to working with them.
- colinbartlett 12y agoI presume they "can't" because it's too expensive? How expensive is too expensive for some of the richest companies in the world?
- nkantar 12y agoWhen it costs more than the perceived value of benefits. "Acceptable risk" is the usual term, I believe.
- einhverfr 12y ago> Why are financial institution so _bad_ at password policies? Legacy code written quickly in 1998 and not replaced yet?
- paulschreiber 12y agoAfter receiving unsatisfactory responses from my local Schwab rep here in New York and the customer service staff, I complained to Schwab's CISO, Bashar Abouseido <bashar.abouseido@schwab.com>, on September 1. He never replied.
- pg_is_a_butt 12y agowhy did you remove the headline part about their policies being CRIMINALLY TERRIBLE. yes, "comedic" might not be completely correct, it did describe the tone of the article: NOT GOOD. anyone with money in a schwab account schould schip all their schillings home, and tell schwab to schuck it.
- paulschreiber 12y agoSchwab does let you enter your token code on a separate screen. If you enter your username and password (without appended token code), you'll get this screen: https://www.flickr.com/photos/paul/16079572151/ https://www.flickr.com/photos/paul/16079572151/
- jeremyt 12y agoYou're correct, but that doesn't fix the first activation, which is what I wrote the post about. The real problem is that I thought I had two factor activated for months when I didn't.
- paulschreiber 12y agoTrue. I was so confused when I got my token — it didn't come with instructions, and there was no activation link on the site. I ended up calling support to figure out how to set things up.
- tuzakey 12y agoIt may be much worse than you think. Another large brokerage company I know of has similar password requirements. They also have a phone banking system, to use it you have to touch tone in your password. On a whim I tried entering the keypad version of my password on the website and surprise! it worked. Luckily for me there is zero customer liability for fraud on their retirement accounts.
- spacefight 12y ago"Like probably millions of people I have a Schwab brokerage account, and that account holds a good portion of my savings for retirement." OpSec 101: replace that sentence with "Like probably millions of people I have a Schwab brokerage account, and that account holds just a few bucks of play money to try out trading strategies."
- codementum 12y agoLike many others, I just filed a support ticket as well. I'd like one of two outcomes: 1. A public response and plan from Schwab, or 2. An alternative bank/brokerage company that a) takes security seriously and b) is easy to move to.
- ladelfa 12y agoHere's how my rep replied to my email today: "Schwab takes online security very seriously, and all clients are protected against fraud with our SchwabSafe guarantee. This guarantee is available to review online at www.schwab.com/schwabsafe. "I reviewed the website you referenced in your email, but this is well outside my area of expertise. To discuss these items, I would suggest you contact our Technology Support Group at the Help Desk. Their number is 800-433-9196." Uh, no. I'm not going to sit on the phone waiting to tell your Help Desk about why they shouldn't store my password in their DB; that's your fuckin job. I'm much more inclined to spend that hour and a half moving my accounts somewhere secure.
- cddotdotslash 12y agoI just called Schwab about this, and hand to whatever deity you believe in, this is what he told me: Representative: "One of the things we were trying to do with these passwords was make them different from other providers. So we know that they allow multiple character types, and are case-sensitive, so we decided to make them different. That way, you can't use the same password you've used elsewhere and it kind of forces you to come up with a new one." Me: "...that is... I can't even explain how terrible that is." Representative: "Well, Schwab does care about your security and as far as the 8-character limitation goes, the reason you can enter any arbitrary text afterwards is so that if someone is looking over you shoulder they can't tell that it only accepts 8." Points for thinking on his feet?
- arenaninja 12y agoI love the arbitrary restrictions that all these sites come up with that ultimately make them less safe. Yesterday I was setting up some stuff for somebody who knows nothing about tech. IIRC it went like this: * Google: no restrictions, as far as I could tell. * Apple: password not accepted because it MUST contain at least one uppercase letter. Of course, simply knowing that one of the characters MUST be an uppercase letter significantly decreases the number of combinations available
- akerl_ 12y agoLet's not get crazy here: knowing that one of a variable number of characters is uppercase does decrease the keyspace, but it's definitely not a "significant" reduction. The main problem with restrictions like that is that it complicates the UX by requiring somebody to tweak their password manager's generator or its output to match the bogus restriction.
- arenaninja 12y agoAgreed on password manager, but I still think the decrease is significant. I won't run my mouth further and might try to quantify that decrease over the holidays.
- 11thEarlOfMar 12y agoOffers little consolation... Schwab has "...a system which locks you out if you guess the [username,password] combination incorrectly more than twice.." Schwab can improve your security via Verisign and verbal passwords, but you have to ask for it: "... Schwab has several additional (optional) verification methods." http://www.marottaonmoney.com/schwab-verisign-security-measures/ http://www.marottaonmoney.com/schwab-verisign-security-measu...
- elsewhen 12y agoSchwab offers security protection with all accounts: http://www.schwab.com/public/schwab/nn/legal_compliance/schwabsafe/security_guarantee.html http://www.schwab.com/public/schwab/nn/legal_compliance/schw... When payouts on this security guarantee begin to become a meaningful burden, I am sure Schwab will improve their security practices.
- jdeibele 12y agoThanks for calling attention to this. I've been frustrated by it. One thing that I did was let LastPass generate 32 random characters for the password but used it to change the username. I depend on LastPass to remember that. It's not much but it was all I could come up with. My wife wants to use the Schwab app to deposit checks on her phone but I don't trust their security. One lost phone could lead to our retirement funds being transferred to Belize (or wherever).
- acconrad 12y agoI, too, complained months ago about the poor password protection. I immediately had them send me a 2-factor FOB. While it isn't a great solution, it's one I would ask for asap.
- DrJosiah 12y agoDid you read the article?
- cdolan 12y agoWhile I see your implied point, DrJosiah, the above commenter did not say that the authenticator was without issue. Moreover, the blog post did not attempt to prove that the 2 factor auth did not work IF configured properly, but that the UI was incredibly misleading when activating the token.
- DrJosiah 12y agoGo read the article (or the first 2 paragraphs even), then come back and read the comment. The point of the article was that Schwab's login security is so broken, even when you do all of the right things yourself, Schwab's implementation of passwords and 2-factor auth may make you think that everything worked when it didn't. It is my opinion that someone who had read the article, had a Schwab account, and who had enabled 2-factor auth for that account would have responded to or added to the experiences expressed by Jeremy Tunnell. But there are no words in acconrad's post that leads me to believe that they read the article before posting, as it basically amounts to, "When I contacted them about crappy password security, I ended up with a 2-factor fob. You should get one too." ... which is great advice for any system offering 2-factor auth, but it basically ignores the whole purpose of the article, which was to point out how utterly broken the entire process is. Could I be wrong and acconrad actually read the article first? Sure. But I asked a question which embodied my opinion on the matter, based on what I read up until that point. And so far, I've not seen any evidence to the contrary to change my belief that acconrad commented without reading the article (your reply doesn't contain information/evidence that is applicable to the question that I asked, as I have at no point offered an opinion that you are responding to). But I've spent entirely too long replying, and won't be following up further. Good day.
- einhverfr 12y agoHaving worked on some major financial web sites (globally), including password code, I can say a few things that may be relevant. The thing is, you never get a sense of how bad legacy code can be at restricting options in reforming sanity until you have worked on such sites. It took me about 5 months to restore sanity to one codebase with a bunch of problems regarding encryption and passwords. Fortunately security was a priority, and not just security checkboxes in PCI requirements but real security. But it wasn't cheap and it wasn't easy, and we ran into a lot of unpleasant surprises along the way. Looking at this the chance is that you have tons of legacy code, and these fit together in not very nice ways. People are afraid to change things because of PCI requirements, security scan results, etc. And the cost of fixing things my be very high. In these cases, I can imagine a "don't rock the boat" mentality developing and a large part of security-critical code becoming effectively untouchable.
- mdaniel 12y ago> I've never, ever seen this "append stuff onto your password" approach being used. Then he doesn't have an eBay or PayPal token, because they both do it. Or rather, it is an option to do it that way, in order to skip over the "submit, enter token, submit" workflow. https://www.paypal.com/us/webapps/helpcenter/helphub/article/?solutionId=FAQ2357#helpcenter_article_content https://www.paypal.com/us/webapps/helpcenter/helphub/article...
- McGlockenshire 12y agoIt's worth noting that some of the two-factor systems that integrate with RADIUS also use this same method, where you can't control how the end system prompts users to authenticate.
- themckman 12y agoIt's really a shame they're so bad at all of this. I've had nothing but a fantastic experience when dealing with them for my Investing and Checking accounts.
- jrochkind1 12y agoRecently, on a Schwab competitors site, I couldn't recall my password -- which was required to have upper, lower, and punctuation. Not being able to recall my password, I was able to reset it by supplying only my mother's maiden name and my date of birth. Um.
- greggarious 12y agoI pointed this out to them over a year ago: http://norcie.com/2013/09/01/schwab-unsafe/ http://norcie.com/2013/09/01/schwab-unsafe/ I went to far as to get in contact with senior staff members at Schwab to alert them to the issue, and got a pretty condescending response. I mentioned it to a friend at a burrito truck outside the Mozilla office, and soon found out it was a top post on /r/personalfinance. I got a call from Schwab shortly after that. But the rep I talked to just said they were "working on" allowing more characters in the password. I must say though, this post does a great job detailing their 2F solution. I never set it up since it seemed like wearing a fishnet condom given the rest of their security, so I never got to see how bad it is.
- kevinburke 12y agoI had pretty much the same experience with Virgin Mobile last year (passwords limited to 6 digits, no brute force protection). I finally told the guy I got escalated to that if they didn't do anything I'd call the NY Times, Consumerist, Gawker, CNET, Ars, etc and tell them about it. They didn't do anything, so I sent around the article and pretty much every publication I sent it to ran with it. After that they took down the login page for about nine hours and brought it back up with brute force protection. https://kev.inburke.com/kevin/open-season-on-virgin-mobile-customer-data/ https://kev.inburke.com/kevin/open-season-on-virgin-mobile-c...
- dmix 12y agoHmm, this might motivate me to take my complaining about security beyond twitter.
- gesman 12y agoEnterprise support: Q: "Your secure banking portal has critical vulnerability!" A: "Did you try to reboot your computer?"
- jkupferman 12y agoFidelity had a similarly terrible password policy (6-12 characters, only letters and numbers). I complaining to their tech six months ago and got a stock "we're looking into it" answer. In the past month they've actually fixed the issue and now require 6 characters (upper case, lower case, number and symbol).
- based2 12y agotx ldap active directory http://www.richardhyland.com/diary/2009/05/06/8-bit-characters-in-active-directory/ http://www.richardhyland.com/diary/2009/05/06/8-bit-characte...
- timdierks 12y agoI'm guessing that if they had a major breach because of this kind of idiocy, they'd find a way to fix it after the fact. Which sort of implies to me that they should find a way to fix it before they have a big breach. If nothing else, the fact that they've been warned repeatedly and done nothing could be pretty compelling if there was ever litigation over losses. For example, I could imagine someone successfully disavowing a trade at Schwab because they don't enforce the password authentication they claim to, and thus can't convincingly claim that the trader was in fact the account owner.
- caycep 12y agoHow do the other big consumer trading services compare? i.e. Vanguard, Fidelity, etc?
- ntucker 12y agoI used to have my retirement accounts at Fidelity. One day I needed some assistance with something I was seeing on their web UI, so I called them up. The support person said (not an exact quote, but the gist), "in order to see what you're seeing, I'm going to need to log in as you. I need your permission in order to do that. Security precautions prevent me from being able to see your password, so I will need to change your password to a temporary password of '123456fidelity' to proceed. Is this ok?" I was kind of speechless, but I said, no, that's ok, I've decided I don't need help anymore, and shortly thereafter I closed all of my accounts. I've moved to a smaller firm where I've specifically asked for my accounts to be inaccessible from the internet in any way, and I have a financial advisor assigned. If I need something done, I can call him or his assistant. I can't make big financial moves at the click of a button, which suits me just fine.
- kelnos 12y agoCertainly less important than a financial institution, but I had the exact same experience calling Virgin America's support a few months ago when their then-new website would consistently error out every time I tried to book a flight.
- cheald 12y agoVanguard enabled proper 2FA a little while ago. It's SMS-based, which is a pity, but it's better than Schwab's abortion of a system.
- ufmace 12y agoI've been coming to an opinion on these issues that may be unpopular with the tech crowd: The big banks have the right idea when it comes to security, and we are misguided at best with our obsession over the minutia of password handling. Why? All of these big banks and investment houses have holdings in the neighborhood of billions of dollars. Like billions in actual cash. If they are so vulnerable and insecure, why aren't all of the hackers targeting them, with their potential upside of billions of dollars in cash, and instead target little web apps to steal some credit card numbers or user data, worth tens of thousands to maybe a few million on black markets? Think about how much effort we've seen put towards stealing cool Twitter handles and other such trivial things. Does anybody really believe that there aren't many more people working much harder to hack banks, with their billion dollar paydays? They may not be the greatest on password handling, but the evidence suggests that they have a much more healthy security culture overall than your average internet startup. Apparently, they are worlds better at making their systems secure enough that nobody can steal these user databases in the first place. They most likely also have a pile of fraud detection and validation on account activity, especially anything involving moving significant amounts of money out of the accounts. They are probably in the right on this - what's the point in building a perfect lock for the front door if, once an attacker gets in, they can transfer the whole balance to a Russian bank and nobody will notice? Consider how, with some well-publicized recent hacks, you can apparently do anything at all once you get through that front door at most major tech companies. I'll happily change my tune if any of these banks get hacked and lose big money. Until then, maybe we should ask these banks how they get it so right overall instead of worrying and hassling them about how long their passwords are and how they're storing them.
- briholt 12y agoJP Morgan got hit pretty hard. https://news.ycombinator.com/item?id=8403459 https://news.ycombinator.com/item?id=8403459
- ufmace 12y agoHmm, looking at that, I'd say it more proves my point. At the top of their Wikipedia entry[0], it says that JPMorgan Chase has roughly 2.5 TRILLION in assets. According to this[1] site, 1.29 TRILLION in customer deposits. Hackers believed to be from Russia breached some of their systems and stole... drumroll please... customer names, addresses, phone numbers, and email addresses. There's stuff in there of value comparable to national economies, a mind-boggling amount of money, and they didn't get a penny of it. All they got was a glorified phone book. Apple can't seem to protect their Apple IDs or iCloud data from determined attackers. Amazon and GoDaddy have given over total control of user's accounts to pretty simple social engineering attacks, both giving the attackers the keys to the castle. None of these attackers seem to have much in the way of funding or organization, and the stolen data doesn't seem to monetize terribly well. Do you think these companies would be able to keep trillions of dollars of their customers' money safe from attackers? Chase seems to be able to. Maybe the tech companies should take a few lessons from them. [0] http://www.wikiwand.com/en/JPMorgan_Chase#/Financial_data http://www.wikiwand.com/en/JPMorgan_Chase#/Financial_data [1] http://www.marketwatch.com/investing/stock/jpm/financials/balance-sheet http://www.marketwatch.com/investing/stock/jpm/financials/ba...
- superuser2 12y agoOnline banking is largely a read-only proposition. It's mostly for reading account activity. Some of the more forward-looking banks will even let you initiate ACH transfers, but generally sending money to a new recipient triggers a 2FA prompt (debit card number prompt, phone call, text) and several secondary notifications, with several days to say "that wasn't me" before the money is gone. I wouldn't voluntarily post my bank account credentials on the internet, but at the end of the day, the security of an online banking account just doesn't matter very much. The security of the transaction mechanisms do, sure, but that's got little to do with online banking passwords.
- brini 12y agoI've also bemoaned Schwab's password policy. I reacted by changing my login ID to something nonsensical which would be difficult to guess or to associate with anyone's identity, let alone mine.
- lukastsai 12y agoa more readable version: https://getscroll.com/r/ba19m https://getscroll.com/r/ba19m