Your Mother’s Maiden Name Is Not a Secret • Hacker News Board

Re: Your Mother’s Maiden Name Is Not a Secret

#101

Post by perseusprime11 » Sat, Dec 30, 2017, 4:50 AM UTC

Aardwolf wrote: post #4

Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…

Not just our banking, but same applies to our education, healthcare, transportation, etc

Re: Your Mother’s Maiden Name Is Not a Secret

#102

Post by the8472 » Sat, Dec 30, 2017, 4:59 AM UTC

Aardwolf wrote: post #14

zkms wrote: post #7

Earlier quoted context omitted.

> maybe a slow cobol mainframe somewhere Inter-bank money transfers in US are handled by a system that needs multiple "business days" for a transaction to be finalised so you're on the money here: https://engineering.gusto.com/how-ach-works-a-developer-pers...

Oh european banks also like to keep the money for a day. Other than that day of interest it's free though :) no 25 dollar wiring fee as seen in US

Since November EU regulation mandates that SEPA transfers should finish within 10 seconds[0]. In practice we're not quite there yet since some smaller regional banks have trouble moving from batch processing to streams, but their deadline extension ends june 2018.

[0] https://www.europeanpaymentscouncil.eu/sites/default/files/K...

Re: Your Mother’s Maiden Name Is Not a Secret

#103

Post by thekingshorses » Sat, Dec 30, 2017, 5:01 AM UTC

_wp3r wrote: post #46

Aardwolf wrote: post #4

Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…

A wire transfer(IBAN/BIC transfer) is different from an ACH transfer. ACH(EFTS in EU) in the US is generally free, but has a delay for clearing and has some mechanisms for reversal. This is primarily a digital check, and can be initiated by the receiver in that way. A wire transfer is nearly immediate by comparison and offers almost no option for reversal. This option does usually have a fee and is generally reserved…

> ACH(EFTS in EU) ... is primarily a digital check.

Well not exactly. I have set up ACH transfer between my dad and my account, but a couple of banks didn't let me. They are like both account holder should be the same. Bank told me that the only option I have is to wire the money.

On the other hand, I pay my employees through ACH (ADP take cares of it).

Re: Your Mother’s Maiden Name Is Not a Secret

#104

Post by juergbi » Sat, Dec 30, 2017, 5:08 AM UTC

germanier wrote: post #78

pedrosorio wrote: post #24

Earlier quoted context omitted.

> Between European bank accounts in the same country. Also, not every European country, unfortunately. Currently there are 34 countries in the SEPA (Single Euro Payments Area): https://en.wikipedia.org/wiki/Single_Euro_Payments_Area SEPA rules specify that you cannot charge more for transfers between different countries than you would for a local transfer. https://europa.eu/youreurope/citizens/consumers/financial-pr.…

Note that this rule doesn't apply to the whole SEPA area. Switzerland is a notorious exception, Euro SEPA transfers to there often incur a charge.

Euro SEPA transfers between Switzerland and EU are typically free. At least the major Swiss banks don't charge anything extra. International transfers in other currencies (e.g., CHF, GBP) still incur a fee, though.

Re: Your Mother’s Maiden Name Is Not a Secret

#105

Post by u801e » Sat, Dec 30, 2017, 5:15 AM UTC

motherdearest wrote: post #97

u801e wrote: post #91

What banks should really do instead of just using passwords or 2-factor authentication is to use client TLS certificates in addition to the standard username and password. The bank can advertise instructions on how to generate a certificate signing request, have you bring it in when you open an account, have the bank issue you a client certificate and have them give you instructions on how to import it into your web…

I can just imagine my mother getting flustered after reading the words "certificate signing (sic?) Request" and stop reading at "client certificate". I can think of very elaborate security measures. The trick is to make them sound easy and relatable to a ranch hand and 1960s housewife. These people smart but they don't have the same life experiences

It may sound difficult at first, but with plenty of help (step-by-step tutorials, etc.) provided by the bank, then it shouldn't be too hard to implement. It could be started as a trial for a certain subset of customers and then rolled out to larger and larger groups as time goes on.

Banks could provide an incentive by stating that using this is much more secure than just using a password, and that it's also largely automatic (unlike 2FA).

Re: Your Mother’s Maiden Name Is Not a Secret

#106

Post by owenversteeg » Sat, Dec 30, 2017, 5:23 AM UTC

the8472 wrote: post #102

Aardwolf wrote: post #14

Earlier quoted context omitted.

Oh european banks also like to keep the money for a day. Other than that day of interest it's free though :) no 25 dollar wiring fee as seen in US

Since November EU regulation mandates that SEPA transfers should finish within 10 seconds[0]. In practice we're not quite there yet since some smaller regional banks have trouble moving from batch processing to streams, but their deadline extension ends june 2018. [0] https://www.europeanpaymentscouncil.eu/sites/default/files/K...

Huh, that's interesting. I remember transferring a few euros for shared pizza to a friend's account a few months back and it took a day. This was between two very large, modern Dutch banks.

Re: Your Mother’s Maiden Name Is Not a Secret

#107

Post by cmurf » Sat, Dec 30, 2017, 5:26 AM UTC

Set a "verbal password". Most banks support these, but most customer service reps haven't heard of them (this is slowly improving). And it seems if you "forget" this verbal password there's no guarantee the bank won't give you an alternate work around like asking for more answers to stupid security questions.

Anyway, it's worth a shot: https://krebsonsecurity.com/2017/11/simple-banking-security-...

Re: Your Mother’s Maiden Name Is Not a Secret

#108

Post by ncallaway » Sat, Dec 30, 2017, 5:27 AM UTC

ufo wrote: post #31

MistahKoala wrote: post #11

Those of us with double-barreled surnames have been keenly aware of this for quite some time.

Another thing I am surprised no one mentioned yet is mothers who didn't change their last name after marrying.

Yup. My mother didn't change her name after marrying and my middle name is her last name.

I'm sure it's secure to use her maiden name as part of my account confirmation, though (/s).

Re: Your Mother’s Maiden Name Is Not a Secret

#109

Post by dreamfactored » Sat, Dec 30, 2017, 5:28 AM UTC

alsetmusic wrote: post #50

StavrosK wrote: post #20

Earlier quoted context omitted.

> Between European bank accounts in the same country. Also, not every European country, unfortunately. Unless I'm mistaken, transfers in Europe are by law required to cost the same inside and out of the country. My Greek bank charges 1 euro for a transfer, no matter if the bank is in Greece or anywhere else in the EU. My German bank doesn't charge anything, and I pay my rent from my German account. > They're very rar…

> None of the banks I have accounts with ever gave me a chequebook. We have to request them and pay a small fee for them. They aren’t typically issued when you open the account. You just receive a debit card. Exceptions may exist. This is only my experience.

You can write a cheque on anything as it's just a written instruction. Sadly the story of the farmer who wrote one on the side of a cow turns out to be false.

Re: Your Mother’s Maiden Name Is Not a Secret

#110

Post by mitchty » Sat, Dec 30, 2017, 5:36 AM UTC

Latty wrote: post #79

nicc wrote: post #9

My bank (Fineco) requires passwords to be 8 characters. Yup, I don't mean minimum or maximum, but exactly 8 characters. That's got to make brute-forcing about 1,000,000 times easier, and I cannot think of a single good reason to impose this. I bet huge numbers are "12345678" and "password".

> I cannot think of a single good reason to impose this. Good? Definitely not, but my money is on CHAR(8) and a lack of understanding.

Dollar to a donut, there is or was a mainframe involved in authentication that has an 8 character password. I even bet the company that sold it was IBM. I remember finding out at one job that the "reason" for the 8 character password requirement for one of our logins, was "you can type as much as you want, but eventually we just take the first 8 characters and use that to log you into the mainframe as thats all it accepts".

Mainframes are weird, and not all that dynamic.