21–30 of 75 posts
Personally I use password managers for most things, but exclude them when money is involved and opt to remember those.
Aren't password managers sacrificing security for convenience? Remembering hundreds of long unique passwords being the most secure, but too difficult. If you could remember everything then you would have an uncompromisable storage system. Personally I use password managers for most things, but exclude them when money is involved and opt to remember those.
We don't live in that world, and as such, a good password manager is the most practically secure method for the vast majority of folks.
American Banks are no different, they just don't tell you out loud. Here's a similar thing with Citi Bank credit card. https://twitter.com/aruncxy/status/1163447301592891392?s=09
Aren't password managers sacrificing security for convenience? Remembering hundreds of long unique passwords being the most secure, but too difficult. If you could remember everything then you would have an uncompromisable storage system. Personally I use password managers for most things, but exclude them when money is involved and opt to remember those.
Half of Android "password managers" are scams.
For any customers that do use said bank, take this as an indicator of their own security practices and consider if you still trust them with your money, data and PII. I wonder how they share credentials without a PAM or similar. All service accounts are using 'S3cur3P@$$w0rdzSuck'... Or more probably just a 'passwordz'? What a shocking state of affairs.
But I do totally agree with you that if they're blocking password manager functionality then it follows that there are probably many more security practices they're similarly getting completely wrong. It's especially concerning when you think of how basic an error this is to be making.
I don't know how security policies are written at companies their size, but there are so many resources on the benefits of password managers it's hard to believe no one could google "should you disable copy pasting passwords" and then read any link from the last 10 years which will unambiguously say: No!
Another weird security issue I noticed with them last week, is that they seem to have their email template sharepoint public [1]. This could be commonplace, since you can't edit anything, but still seems weird that you would let just anyone traverse your directories.
[0] https://chrome.google.com/webstore/detail/dont-fuck-with-pas... https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi... [1] https://www.mailers.fnbweb.co.za/Campaigns/Forms/AllItems.as...
I'm frequently baffled when I encounter a login form that doesn't allow pasting a password. Of course with developer tools I can just remove the attribute that causes that, but plenty of internet users lack that level of technical knowledge and are forced to resort to easy to member and very likely reused passwords. I feel like this is a similar red flag as the 'no single quotes in passwords' limitation that used to…
Aren't password managers sacrificing security for convenience? Remembering hundreds of long unique passwords being the most secure, but too difficult. If you could remember everything then you would have an uncompromisable storage system. Personally I use password managers for most things, but exclude them when money is involved and opt to remember those.
One of the security features that a password manager provides is retrieving passwords based on what domain you're on. They're a lot better than the human brain at making sure you don't get phished by an evil site that looks exactly like Gmail or whatever.
Aren't password managers sacrificing security for convenience? Remembering hundreds of long unique passwords being the most secure, but too difficult. If you could remember everything then you would have an uncompromisable storage system. Personally I use password managers for most things, but exclude them when money is involved and opt to remember those.
It depends on what problem you're trying to solve / what's your threat model. The comparison is for realistic (imperfect) use of password manager vs what someone would do otherwise.
Nobody is likely to ever guess your bank password with online tries, so the likely scenarios are: protection from hashed credentials leak, and from another service leaking shared passwords. The tradeoff is your password manager bring possibly exploited. With the known frequency of each so far, no, it doesn't look like we're sacrificing security.