Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How could online banking stop sucking

micho.biz

Post reply on HN
Print view View original

21–30 of 39 posts

Re: How could online banking stop sucking

#21

Post by rmcclellan »

This article has several ideas that are fundamentally flawed - but here's the most easily falsifiable one:

"What’s worse, a weak password, or a password that sits on your desk?"

Contrary to what is said in the article, a weak password is worse - no question. A password that sits on my desk is only available to people who break into my home. If they do that, they probably have access to other documents of some importance.

A password that is weak can allow anyone access to my account, from anywhere.

Re: How could online banking stop sucking

#22

Post by URSpider94 »

Sorry, but I have to disagree with many of your suggestions.

1. Log in from the home page: This would require the bank to serve its home page from https, including a redirect from http for every visitor, in case he or she wants to log in.

2. 4-digit passcodes: You're missing the key point about your ATM login -- it's only secure because it combines something you have (your ATM card) with something you know (your PIN). If everyone's login is a 4-digit number, then if I have a list of 10,000 users of your system, it would be trivial for me to compromise at least one account (not of my choosing) without even resorting to multiple login attempts.

3. Setting all login ID's to users' email addresses: This just removes more entropy from the login security process, since I now know that logins come from the set of valid email addresses. For any individual user, I now know their login with a high degree of certainty.

4. API: Do you think that banks really want to circumvent their security measures by allowing third parties to hold keys to the front door, even if the proverbial vault is locked?

All that said, I do agree that there are things that could be improved: making the login button front-and-center, so I don't have to guess where to find it; giving better choices for exporting financial data. But, you've got to realize that banks (online and offline) are prime targets for criminals, and that in some ways user experience has to take a back seat to protecting assets.

Re: How could online banking stop sucking

#23

Post by blakefrost »

rmcclellan wrote: post #21

This article has several ideas that are fundamentally flawed - but here's the most easily falsifiable one: "What’s worse, a weak password, or a password that sits on your desk?" Contrary to what is said in the article, a weak password is worse - no question. A password that sits on my desk is only available to people who break into my home. If they do that, they probably have access to other documents of some importa…

He mentioned login attempts in the article. Someone tries the wrong password more then a few times and the account gets locked. That should thwart any and all dictionary/brute force/you name it attacks. So which is more secure, an impossible to accomplish remote attack, or a password sitting on your desk?

Bank password polices are retarded. I currently have one that requires 6 characters. No more, no less. This may be the worst offense I've seen but it doesn't excuse the other bullshit that passes as secure or acceptable in the banking arena. These guys need help.

Re: How could online banking stop sucking

#24

Post by zwischenzug »

michokest wrote: post #11
georgefox wrote: post #9

Earlier quoted context omitted.

Agreed. While some of the opinions are valid and useful, the idea of intentionally setting up weak authentication for an online bank account seems absurd. (Did he really suggest accepting an e-mail address in lieu of a password?) Banks often have you confirm recent transactions on your account to verify your identity (over the phone, for example), making this data pretty sensitive. But even setting that aside, I thin…

It's not "intentionally weak authentication" – it's optionally weak authentication, so users can choose how hard it is to see their data. Something completely different is securing sending out money

I think you've missed the point.

It's not sufficient to let the user decide how much security they should have. It won't protect the banks from the expectations of security placed on them by others, however unreasonable that might seem.

Re: How could online banking stop sucking

#25

Post by jdietrich »

Most British banks require two-factor authentication. My bank (Barclays) allows me to login without sending a password over the wire. I insert my debit card into a reader and enter my normal PIN, which generates a one-time password. The scheme is remarkably well-designed and defeats all of the usual attacks[1].

Crucially, I must generate a different one-time password using a different procedure if I wish to transfer money to someone I haven't previously paid. This essentially puts paid to phishing and man-in-the-middle, as an authenticated session isn't enough to do anything malicious; To steal my money, you would have to either completely break the cryptosystem, or convince me to enter your account number into my card reader to generate the necessary one-time password.

[1] http://www.barclays.co.uk/Helpsupport/IntroducingPINsentryfo...

Re: How could online banking stop sucking

#26

Post by zdw »

Give me a freaking API and all the other issues go away.

Also, stop restricting the data I can download to the most recent 30-90 days.

Paypal and Amazon both let me download my entire purchase history (>5 years for both) with a ton more detail than the bank.

If security is an issue give me a client SSL cert and force me to do 2 factor login (SSL cert + password) to grab a feed of data. This isn't rocket science - it's me wanting a simple "select * from checkingaccount" from your database on the other end of a HTTP request.

Re: How could online banking stop sucking

#27

Post by rmcclellan »

blakefrost wrote: post #23
rmcclellan wrote: post #21

This article has several ideas that are fundamentally flawed - but here's the most easily falsifiable one: "What’s worse, a weak password, or a password that sits on your desk?" Contrary to what is said in the article, a weak password is worse - no question. A password that sits on my desk is only available to people who break into my home. If they do that, they probably have access to other documents of some importa…

He mentioned login attempts in the article. Someone tries the wrong password more then a few times and the account gets locked. That should thwart any and all dictionary/brute force/you name it attacks. So which is more secure, an impossible to accomplish remote attack, or a password sitting on your desk? Bank password polices are retarded. I currently have one that requires 6 characters. No more, no less. This may b…

I'm not trying to say that bank password policies make sense. They do need help.

"Allow weaker passwords and limit login attempts" is not the solution either, because it gives an attacker who has discovered my user id but not my password the ability to lock my account.

Re: How could online banking stop sucking

#28

Post by viraptor »

URSpider94 wrote: post #22

Sorry, but I have to disagree with many of your suggestions. 1. Log in from the home page: This would require the bank to serve its home page from https, including a redirect from http for every visitor, in case he or she wants to log in. 2. 4-digit passcodes: You're missing the key point about your ATM login -- it's only secure because it combines something you have (your ATM card) with something you know (your PIN)…

> This would require the bank to serve its home page from https, including a redirect from http for every visitor

And that's a bad idea why exactly?...

> Setting all login ID's to users' email addresses: This just removes more entropy from the login security process, since I now know that logins come from the set of valid email addresses.

Currently the username in my bank is a 9-digit number and they've got "over 30 million customers" I'm pretty sure I can guess a valid username in under 10 tries ;) Meanwhile, emails are almost an unlimited search space. The only thing that changes is that you're more likely to know who does the email belong to.

Re: How could online banking stop sucking

#29

Post by oasisbob »

URSpider94 wrote: post #22

Sorry, but I have to disagree with many of your suggestions. 1. Log in from the home page: This would require the bank to serve its home page from https, including a redirect from http for every visitor, in case he or she wants to log in. 2. 4-digit passcodes: You're missing the key point about your ATM login -- it's only secure because it combines something you have (your ATM card) with something you know (your PIN)…

Forced SSL isn't a bad idea, nor is it hard. Many banks already do this.

Most banks already offer an API, in the form of OFX. The security measures (like challenge questions) are already circumvented, and I've seen some really bad security flaws in OFX implementations when I last played around. e.g., inter-customer money transfers without requiring anything but the password, no auth lockout making brute-forcing possible, ability to crash the OFX gateway, &c.

(Yes, the newer OFX standards support multi-factor authentication, but I don't know of a single bank that uses the newer version.)

Also, most FIs hate the idea of financial aggregation, being worried about other companies cross-selling to their customers.

A sane REST API would be a wonderful step in the right direction, but I doubt it'll happen in the next ten years on a large-scale. Getting OFX to where it stands now took the combined market forces of Intuit and Microsoft many years, and didn't turn out well.

Re: How could online banking stop sucking

#30

Post by spacemanaki »

I don't mind the crappy web interfaces because I have bigger complaints about modern consumer banking. I really don't understand how loose sloppy a lot of it feels to me, and how old school other parts feel. Here are a few of examples from my very recent past:

1) I had a check stolen. The thief was able to write themselves (or someone they know) a check for $100, sign it with my name, and deposit or cash it. I only discovered this after seeing the transaction in my history and notifying the bank. The forged signature was looked completely different from my own. What's the point of a signature if it's not used for authentication?

2) Because of the above, during the fraud claim process I had to close my account. This disrupted my direct deposit and my employer attempted to deposit my paycheck into a closed account. I didn't realize this until the payment was being returned. I was told that I would have to wait 5 business days for the payment to be resolved. Why isn't this instantaneous? Why do high frequency firms enjoy millisecond trading while consumers have to wait what is basically the equivalent of postal mail delays for electronic transactions? I'm sure this is vastly simplified (HFT firms colocate with exchanges, consumer banks must have to comply with regulations that necessitate these delays) but it does seem that the ordinary consumer is being screwed out of some innovation here.

3) Finally, just this past week, someone accidentally deposited over $1000 into my account. They must have made a mistake with the account number. I told the bank about it, and it still hasn't been resolved. How is this even possible? From what I understand, all you need to withdraw and deposit money from an account is the combination of routing number and account number, and this seems so crazy in the way it opens up for mistakes or abuse.

Of course, I'm likely underestimating the complexities and histories here so I would be very happy to have my naivete corrected.

Post reply on HN