Earlier quoted context omitted.
I’d bet half of all Android apps are scams.
I bid higher...
I'm sure there is an app that could tell us the true count.
South African bank advises against the use of password managers
11–20 of 75 posts
Re: South African bank advises against the use of password managers
#12I'm frequently baffled when I encounter a login form that doesn't allow pasting a password. Of course with developer tools I can just remove the attribute that causes that, but plenty of internet users lack that level of technical knowledge and are forced to resort to easy to member and very likely reused passwords. I feel like this is a similar red flag as the 'no single quotes in passwords' limitation that used to…
I can understand if a government service requires this but it also happens with a normal, ecommerce website!
Re: South African bank advises against the use of password managers
#13Password managers are a very useful idea for general accounts, but I would not trust my financial solvency to them. If you only have one or two bank accounts, generate a long complex password, memorize it, don't save it anywhere, and use a mnemonic or other method to vary the password between the two accounts.
Even if password managers are implemented perfectly, there are various attacks that they can still fall victim to that a memorized password won't. Most password managers are not implemented perfectly.
Re: South African bank advises against the use of password managers
#14“Bank has idiotic ideas about security” is as surprising as “sun rises at predicted time.” Something about the industry seems to push paranoid incompetence in security.
Currently at a bank's security team, here's what I gathered so far that explains (but doesn't excuse) the current state of affairs:
- there are millions of customers who hate having to use their brains (or get their phone to receive a 2FA code);
- a kilometer of requirements from whatever Central Bank, local policies and ad-hoc decisions;
- (too) limited budget to build and run whatever service (cost of SMS 2FA for millions .vs. cost of some limited fraud);
- very, very bad dev education, and general disdain for security. We do have a guide for them (the "secure development handbook"), and all our code audits reveal that it wasn't followed in all places;
- outdated perception of security issues (screengrabbers are still a threat to tackle, according to some).
Re: South African bank advises against the use of password managers
#15I'm frequently baffled when I encounter a login form that doesn't allow pasting a password. Of course with developer tools I can just remove the attribute that causes that, but plenty of internet users lack that level of technical knowledge and are forced to resort to easy to member and very likely reused passwords. I feel like this is a similar red flag as the 'no single quotes in passwords' limitation that used to…
I can understand if a government service requires this but it also happens with a normal, ecommerce website!
I really don't understand why. Please explain.
Re: South African bank advises against the use of password managers
#16American Banks are no different, they just don't tell you out loud. Here's a similar thing with Citi Bank credit card.
Re: South African bank advises against the use of password managers
#17“Bank has idiotic ideas about security” is as surprising as “sun rises at predicted time.” Something about the industry seems to push paranoid incompetence in security.
Currently at a bank's security team, here's what I gathered so far that explains (but doesn't excuse) the current state of affairs: - there are millions of customers who hate having to use their brains (or get their phone to receive a 2FA code); - a kilometer of requirements from whatever Central Bank, local policies and ad-hoc decisions; - (too) limited budget to build and run whatever service (cost of SMS 2FA for m…
Thank you for sharing an inside view!
Re: South African bank advises against the use of password managers
#18Half of Android "password managers" are scams.
Have you got the numbers for it, and a proof that significant number of people actually use them? Searching for password manager I got to 16th entry before reaching an unknown author and ~40 positions before I reached anything really questionable. Even assuming the install numbers are not inflated, you don't get more than 10k users on the lower entries.
There are probably some scams down the list, but claiming half of them are without an explanation is just FUD.
Re: South African bank advises against the use of password managers
#19I'm frequently baffled when I encounter a login form that doesn't allow pasting a password. Of course with developer tools I can just remove the attribute that causes that, but plenty of internet users lack that level of technical knowledge and are forced to resort to easy to member and very likely reused passwords. I feel like this is a similar red flag as the 'no single quotes in passwords' limitation that used to…
I can understand if a government service requires this but it also happens with a normal, ecommerce website!
If it's a US Federal Government service, you should point out to them that they are going against the explicit recommendation of NIST[1].
1. https://pages.nist.gov/800-63-3/sp800-63b.html#sec5, under 5.1.1.2 Memorized Secret Verifiers, 'Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret.'
Re: South African bank advises against the use of password managers
#20I'm frequently baffled when I encounter a login form that doesn't allow pasting a password. Of course with developer tools I can just remove the attribute that causes that, but plenty of internet users lack that level of technical knowledge and are forced to resort to easy to member and very likely reused passwords. I feel like this is a similar red flag as the 'no single quotes in passwords' limitation that used to…
I can understand if a government service requires this but it also happens with a normal, ecommerce website!
I do not understand why a government service would require this. Governments should improve security, not undermine it.
(Then again, most governments don't seem to care much about what I think they should be doing.)