South African bank advises against the use of password managers
1–10 of 75 posts
Re: South African bank advises against the use of password managers
#2Half of Android "password managers" are scams.
Re: South African bank advises against the use of password managers
#3For any customers that do use said bank, take this as an indicator of their own security practices and consider if you still trust them with your money, data and PII.
I wonder how they share credentials without a PAM or similar. All service accounts are using 'S3cur3P@$$w0rdzSuck'... Or more probably just a 'passwordz'?
What a shocking state of affairs.
Re: South African bank advises against the use of password managers
#4Half of Android "password managers" are scams.
I’d bet half of all Android apps are scams.
Re: South African bank advises against the use of password managers
#5“Bank has idiotic ideas about security” is as surprising as “sun rises at predicted time.” Something about the industry seems to push paranoid incompetence in security.
Re: South African bank advises against the use of password managers
#6I'm frequently baffled when I encounter a login form that doesn't allow pasting a password. Of course with developer tools I can just remove the attribute that causes that, but plenty of internet users lack that level of technical knowledge and are forced to resort to easy to member and very likely reused passwords.
I feel like this is a similar red flag as the 'no single quotes in passwords' limitation that used to be common.
Re: South African bank advises against the use of password managers
#7I'm frequently baffled when I encounter a login form that doesn't allow pasting a password. Of course with developer tools I can just remove the attribute that causes that, but plenty of internet users lack that level of technical knowledge and are forced to resort to easy to member and very likely reused passwords. I feel like this is a similar red flag as the 'no single quotes in passwords' limitation that used to…
I prefer to use the autotype function of password managers (Ctrl-V on Keepass[0], and rofi-pass[1] for pass(1)); there are other issues with them though (such as "modern" login pages [2])
[0] https://keepass.info/help/base/autotype.html
[1] https://github.com/carnager/rofi-pass
[2] http://bradfrost.com/blog/post/dont-get-clever-with-login-fo...
Re: South African bank advises against the use of password managers
#8Re: South African bank advises against the use of password managers
#9If you can only remember a few long term complex secrets, then using one slot for your bank password seems reasonable to me. The other big ones for me are: google/microsoft account, password manager, FDE passphrase.
If you use hardware 2FA and have lots of bank accounts (business, trading, etc) then using a password manager starts to make sense.
Re: South African bank advises against the use of password managers
#10For any customers that do use said bank, take this as an indicator of their own security practices and consider if you still trust them with your money, data and PII. I wonder how they share credentials without a PAM or similar. All service accounts are using 'S3cur3P@$$w0rdzSuck'... Or more probably just a 'passwordz'? What a shocking state of affairs.
I use said bank and they are generally pretty good. Also note they even said in the tweet that they acknowledge the role of password managers so I think you may have read a bit too much into the tweet. Almost every time I log on to their online banking site, I get a page detailing the latest scams and what to look out for.
I also agree with their statement for the most part. The general public, at least here in SA, aren't too discerning when it comes to tech matters who will probably download any random app from the play store. If you don't trust pretty much anyone with your credentials, why trust a probably unknown 3rd party with them.
I think the best idea in this case is to choose a strong password, try and remember it or write it down and store it in a safe.