61–70 of 127 posts
I did report this a while ago to Schwab both over the phone and on Twitter and I have been equally ignores. Thanks for writing a blog post about it. Edit: forgot to mention that the passwords are case insensitive!!!!!!
The thing is, you never get a sense of how bad legacy code can be at restricting options in reforming sanity until you have worked on such sites.
It took me about 5 months to restore sanity to one codebase with a bunch of problems regarding encryption and passwords. Fortunately security was a priority, and not just security checkboxes in PCI requirements but real security. But it wasn't cheap and it wasn't easy, and we ran into a lot of unpleasant surprises along the way.
Looking at this the chance is that you have tons of legacy code, and these fit together in not very nice ways. People are afraid to change things because of PCI requirements, security scan results, etc. And the cost of fixing things my be very high. In these cases, I can imagine a "don't rock the boat" mentality developing and a large part of security-critical code becoming effectively untouchable.
Then he doesn't have an eBay or PayPal token, because they both do it. Or rather, it is an option to do it that way, in order to skip over the "submit, enter token, submit" workflow.
https://www.paypal.com/us/webapps/helpcenter/helphub/article...
I did report this a while ago to Schwab both over the phone and on Twitter and I have been equally ignores. Thanks for writing a blog post about it. Edit: forgot to mention that the passwords are case insensitive!!!!!!
You are factually incorrect that the passwords are case insensitive.
I, too, complained months ago about the poor password protection. I immediately had them send me a 2-factor FOB. While it isn't a great solution, it's one I would ask for asap.
8 digits password... It sound like DES encryption stored directly in the database. (This is pure speculation of course) This alone is a huge red flag. Adding the fact that the 2 factor auth. is broken is not a good news.
How about the case insensitivity on the passwords? How does that fit with DES encryption, or any kind of encryption at all?
I did report this a while ago to Schwab both over the phone and on Twitter and I have been equally ignores. Thanks for writing a blog post about it. Edit: forgot to mention that the passwords are case insensitive!!!!!!
You are factually incorrect that the passwords are case insensitive.
Not being able to recall my password, I was able to reset it by supplying only my mother's maiden name and my date of birth.
Um.
I, too, complained months ago about the poor password protection. I immediately had them send me a 2-factor FOB. While it isn't a great solution, it's one I would ask for asap.
Did you read the article?