Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

South African bank advises against the use of password managers

twitter.com

Post reply on HN
Print view View original

31–40 of 75 posts

Re: South African bank advises against the use of password managers

#31

Post by pwg »

mcv wrote: post #6

I'm frequently baffled when I encounter a login form that doesn't allow pasting a password. Of course with developer tools I can just remove the attribute that causes that, but plenty of internet users lack that level of technical knowledge and are forced to resort to easy to member and very likely reused passwords. I feel like this is a similar red flag as the 'no single quotes in passwords' limitation that used to…

With Firefox (at least the desktop version) one can set this about:config option (dom.event.clipboardevents.enabled) to "false" and websites can no longer block you from pasting things into form fields on your own browser on your own computer.

Re: South African bank advises against the use of password managers

#32

Post by vxNsr »

mikeash wrote: post #5

“Bank has idiotic ideas about security” is as surprising as “sun rises at predicted time.” Something about the industry seems to push paranoid incompetence in security.

The most confusing thing is that a lot of banks (paypal included) still don't let you use "special chars" in your password. Or they will allow it but only for a very limited set that they don't tell you.

Re: South African bank advises against the use of password managers

#33

Post by zzzcpan »

moviuro wrote: post #14
mikeash wrote: post #5

“Bank has idiotic ideas about security” is as surprising as “sun rises at predicted time.” Something about the industry seems to push paranoid incompetence in security.

Currently at a bank's security team, here's what I gathered so far that explains (but doesn't excuse) the current state of affairs: - there are millions of customers who hate having to use their brains (or get their phone to receive a 2FA code); - a kilometer of requirements from whatever Central Bank, local policies and ad-hoc decisions; - (too) limited budget to build and run whatever service (cost of SMS 2FA for m…

I guess it depends on the country and the bank. My bank, for example, does mandatory 2FA for 15+ years and uses some anomaly based approach to decide how aggressively to ask for 2FA, like if you send money somewhere unusual, it does phone call 2FA, instead of an SMS, and if you just pay your usual bills from the same IP address and the same PC it doesn't even ask for 2FA at all. It also has other optional security features like white lists for IP subnets, internet-only credit cards, etc.

Re: South African bank advises against the use of password managers

#34

Post by consp »

peterwwillis wrote: post #13

Password managers are a very useful idea for general accounts, but I would not trust my financial solvency to them. If you only have one or two bank accounts, generate a long complex password, memorize it, don't save it anywhere, and use a mnemonic or other method to vary the password between the two accounts. Even if password managers are implemented perfectly, there are various attacks that they can still fall vict…

> a memorized password won't

Memorized password are usually highly insecure due to being reused and short in general. So they are usually implemented as imperfect systems for most people. What is the difference to a password manager here?

The fact you remember long passwords doesn't mean everyone does.

Re: South African bank advises against the use of password managers

#35

Post by kranner »

peterwwillis wrote: post #13

Password managers are a very useful idea for general accounts, but I would not trust my financial solvency to them. If you only have one or two bank accounts, generate a long complex password, memorize it, don't save it anywhere, and use a mnemonic or other method to vary the password between the two accounts. Even if password managers are implemented perfectly, there are various attacks that they can still fall vict…

Name one attack that would work against a non-cloud-based password manager like pass. Note that the encrypted passwords are stored locally and are encrypted with GPG and protected with a (hopefully) complex passphrase. If your answer depends on malware that can read the clipboard, note that the same malware can also log the keystrokes used to type the password manually.

Re: South African bank advises against the use of password managers

#36

Post by tombrossman »

mcv wrote: post #6

I'm frequently baffled when I encounter a login form that doesn't allow pasting a password. Of course with developer tools I can just remove the attribute that causes that, but plenty of internet users lack that level of technical knowledge and are forced to resort to easy to member and very likely reused passwords. I feel like this is a similar red flag as the 'no single quotes in passwords' limitation that used to…

In Firefox you can override this and re-enable pasting by toggling dom.event.clipboardevents.enabled to 'False' (in about:config).

https://developer.mozilla.org/en-US/docs/Mozilla/Preferences...

Re: South African bank advises against the use of password managers

#39

Post by mikeash »

vxNsr wrote: post #32
mikeash wrote: post #5

“Bank has idiotic ideas about security” is as surprising as “sun rises at predicted time.” Something about the industry seems to push paranoid incompetence in security.

The most confusing thing is that a lot of banks (paypal included) still don't let you use "special chars" in your password. Or they will allow it but only for a very limited set that they don't tell you.

This one seems almost sensible to me. They probably have some ridiculous 1960s-era mainframe on the backend and it’s cheaper to keep it running than to redo it all.

Re: South African bank advises against the use of password managers

#40

Post by dsfasfasfas »

sonnk wrote: post #12
mcv wrote: post #6

I'm frequently baffled when I encounter a login form that doesn't allow pasting a password. Of course with developer tools I can just remove the attribute that causes that, but plenty of internet users lack that level of technical knowledge and are forced to resort to easy to member and very likely reused passwords. I feel like this is a similar red flag as the 'no single quotes in passwords' limitation that used to…

I can understand if a government service requires this but it also happens with a normal, ecommerce website!

Well in my little corner of the US govt the web certificates are usually expired and I can't log into my work email from home.
Post reply on HN