Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

South African bank advises against the use of password managers

twitter.com

Post reply on HN
Print view View original

41–50 of 75 posts

Re: South African bank advises against the use of password managers

#41

Post by peterwwillis »

consp wrote: post #34
peterwwillis wrote: post #13

Password managers are a very useful idea for general accounts, but I would not trust my financial solvency to them. If you only have one or two bank accounts, generate a long complex password, memorize it, don't save it anywhere, and use a mnemonic or other method to vary the password between the two accounts. Even if password managers are implemented perfectly, there are various attacks that they can still fall vict…

> a memorized password won't Memorized password are usually highly insecure due to being reused and short in general . So they are usually implemented as imperfect systems for most people. What is the difference to a password manager here? The fact you remember long passwords doesn't mean everyone does.

If you're the type of person who uses no master password, and every password you would ever create is '1234', then a password manager will be a definite improvement. But if you have the ability to memorize two complex passwords, that is more secure.

My advice is solely for the person who already has a password manager, has memorized one complex password for it, and is willing to memorize another one.

Re: South African bank advises against the use of password managers

#42

Post by nomad010 »

alkonaut wrote: post #37

Is there no 2FA? Why is there a password field at all on an online banking page?

Most transactions require an OTP to successfully complete, you also get notifications whenever a login to your account is performed.

I think it would probably be a good idea to have some sort of separate 2FA device linked at home but I doubt they'll ever implement it. You would want it separate to your phone because if your wallet and phone get stolen you can login to the online banking account and deactivate your stolen cards without having to go to the bank.

Re: South African bank advises against the use of password managers

#43

Post by cik »

pwg wrote: post #31
mcv wrote: post #6

I'm frequently baffled when I encounter a login form that doesn't allow pasting a password. Of course with developer tools I can just remove the attribute that causes that, but plenty of internet users lack that level of technical knowledge and are forced to resort to easy to member and very likely reused passwords. I feel like this is a similar red flag as the 'no single quotes in passwords' limitation that used to…

With Firefox (at least the desktop version) one can set this about:config option (dom.event.clipboardevents.enabled) to "false" and websites can no longer block you from pasting things into form fields on your own browser on your own computer.

By far the best comment in this thread. Thank you.

Any idea if that syncs as a regular profix sync?

Re: South African bank advises against the use of password managers

#44

Post by Apofis »

moviuro wrote: post #14
mikeash wrote: post #5

“Bank has idiotic ideas about security” is as surprising as “sun rises at predicted time.” Something about the industry seems to push paranoid incompetence in security.

Currently at a bank's security team, here's what I gathered so far that explains (but doesn't excuse) the current state of affairs: - there are millions of customers who hate having to use their brains (or get their phone to receive a 2FA code); - a kilometer of requirements from whatever Central Bank, local policies and ad-hoc decisions; - (too) limited budget to build and run whatever service (cost of SMS 2FA for m…

This is unintentionally hilarious.

Re: South African bank advises against the use of password managers

#45

Post by zAy0LfpBZLC8mAC »

zzzcpan wrote: post #33
moviuro wrote: post #14

Earlier quoted context omitted.

Currently at a bank's security team, here's what I gathered so far that explains (but doesn't excuse) the current state of affairs: - there are millions of customers who hate having to use their brains (or get their phone to receive a 2FA code); - a kilometer of requirements from whatever Central Bank, local policies and ad-hoc decisions; - (too) limited budget to build and run whatever service (cost of SMS 2FA for m…

I guess it depends on the country and the bank. My bank, for example, does mandatory 2FA for 15+ years and uses some anomaly based approach to decide how aggressively to ask for 2FA, like if you send money somewhere unusual, it does phone call 2FA, instead of an SMS, and if you just pay your usual bills from the same IP address and the same PC it doesn't even ask for 2FA at all. It also has other optional security fe…

That sounds terrible. I mean, I assume they don't assume liability for bad decisions?

If "the PC" or "the IP address" was not contractually agreed to be an authentication factor (that you thus should protect from unauthorized use), it's a terrible idea to use them for authentication, while also (presumably) putting all liability on the customer.

Re: South African bank advises against the use of password managers

#46

Post by alkonaut »

sp332 wrote: post #38
alkonaut wrote: post #37

Is there no 2FA? Why is there a password field at all on an online banking page?

Do you mean logging in with a one-time code instead of a password? It might be more secure than a password, but it's still only one "factor".

No I mean a physical thing like those little number generators that banks have had for what 20 years now, or the smartphone 2FA apps that we have used for at least 15 years.

I don't enter either a regular password nor one-time password for anything (not for transactions, not for login). I only use an identifying mechanism on a second device (a smartphone or a dedicated device). The secondary device has an 8digit pin though, so if it is stolen then it's not (immediately) compromising the security.

Re: South African bank advises against the use of password managers

#47

Post by alkonaut »

nomad010 wrote: post #42
alkonaut wrote: post #37

Is there no 2FA? Why is there a password field at all on an online banking page?

Most transactions require an OTP to successfully complete, you also get notifications whenever a login to your account is performed. I think it would probably be a good idea to have some sort of separate 2FA device linked at home but I doubt they'll ever implement it. You would want it separate to your phone because if your wallet and phone get stolen you can login to the online banking account and deactivate your st…

If the phone has a PIN or similar (I realize not everyone has) and the 2FA app has a pin/password, then that does seem like a reasonable level of security.

Re: South African bank advises against the use of password managers

#48

Post by caseysoftware »

Thirty minutes ago I closed my account with Wells Fargo because of their lack of security. Last month, they called to validate my identity. I called back, they asked for my mother's maiden name.

Me: "Since that information is on Facebook, I use a big random string starting.."

Them: "That's good enough, so what we want to talk about is.."

Then when I went into the local branch, the receptionist wanted to swipe my debit card in their tablet to add me to the line. Forget that, I'm out.

Re: South African bank advises against the use of password managers

#49

Post by peterwwillis »

kranner wrote: post #35
peterwwillis wrote: post #13

Password managers are a very useful idea for general accounts, but I would not trust my financial solvency to them. If you only have one or two bank accounts, generate a long complex password, memorize it, don't save it anywhere, and use a mnemonic or other method to vary the password between the two accounts. Even if password managers are implemented perfectly, there are various attacks that they can still fall vict…

Name one attack that would work against a non-cloud-based password manager like pass. Note that the encrypted passwords are stored locally and are encrypted with GPG and protected with a (hopefully) complex passphrase. If your answer depends on malware that can read the clipboard, note that the same malware can also log the keystrokes used to type the password manually.

Evil maid. Cold boot. Memory parsing. Clipboard/key event hooking. Brute force. Dictionary. Autofill hijack.

You can use the first four against typed passwords, but you either need to have malware installed, or your time window has to be very short. All of these can be used against password managers even without malware, and the time window is much longer, often due to crappy password managers not properly protecting against side channels or even cleaning up old memory.

You have the same attacks as with entering a password, plus more you wouldn't have had.

Re: South African bank advises against the use of password managers

#50

Post by sp332 »

alkonaut wrote: post #46
sp332 wrote: post #38

Earlier quoted context omitted.

Do you mean logging in with a one-time code instead of a password? It might be more secure than a password, but it's still only one "factor".

No I mean a physical thing like those little number generators that banks have had for what 20 years now, or the smartphone 2FA apps that we have used for at least 15 years. I don't enter either a regular password nor one-time password for anything (not for transactions, not for login). I only use an identifying mechanism on a second device (a smartphone or a dedicated device). The secondary device has an 8digit pin…

Yeah that is a one-time code. It's in the name: https://en.wikipedia.org/wiki/Time-based_One-time_Password_a... And again, if you use only this to log in, it's not two-factor authentication because it's only one factor. You'd have to combine it with something else (like a password or a fingerprint) to have two factors.
Post reply on HN