How do the other big consumer trading services compare? i.e. Vanguard, Fidelity, etc?
Vanguard enabled proper 2FA a little while ago. It's SMS-based, which is a pity, but it's better than Schwab's abortion of a system.
Schwab password policies and two factor authentication
101–110 of 127 posts
Re: Schwab password policies and two factor authentication
#102How do the other big consumer trading services compare? i.e. Vanguard, Fidelity, etc?
I used to have my retirement accounts at Fidelity. One day I needed some assistance with something I was seeing on their web UI, so I called them up. The support person said (not an exact quote, but the gist), "in order to see what you're seeing, I'm going to need to log in as you. I need your permission in order to do that. Security precautions prevent me from being able to see your password, so I will need to chang…
Certainly less important than a financial institution, but I had the exact same experience calling Virgin America's support a few months ago when their then-new website would consistently error out every time I tried to book a flight.
Re: Schwab password policies and two factor authentication
#103I've been coming to an opinion on these issues that may be unpopular with the tech crowd: The big banks have the right idea when it comes to security, and we are misguided at best with our obsession over the minutia of password handling. Why? All of these big banks and investment houses have holdings in the neighborhood of billions of dollars. Like billions in actual cash. If they are so vulnerable and insecure, why…
JP Morgan got hit pretty hard. https://news.ycombinator.com/item?id=8403459
Re: Schwab password policies and two factor authentication
#104Earlier quoted context omitted.
Verified, mine is case-insensitive. If phone-keypad-password-entry is a requirement, then that makes sense.
Im confused, are you verifying that the passwords are or are not case sensitive? Mine is certainly case sensitive (watch me get hacked now, 8 characers, one is capital!)
"Case sensitive" means that it matters whether you keep characters matching the same case. So, let's imagine a hypothetical service:
# This should work for any such service:
Service.set_password('MyPassword')
Service.verify('MyPassword')
# These fail if a case-sensitive service
Service.verify('mypassword')
Service.verify('MYPASSWORD')
# They drop characters if these work:
Service.verify('My')
Service.verify('MyVoice')
# I hope not: 'mypassword' phone pad digits
Service.verify(6972779673)
# Even worse, if they might store only the first digits:
Service.verify(6972)
Re: Schwab password policies and two factor authentication
#105I just called Schwab about this, and hand to whatever deity you believe in, this is what he told me: Representative: "One of the things we were trying to do with these passwords was make them different from other providers. So we know that they allow multiple character types, and are case-sensitive, so we decided to make them different. That way, you can't use the same password you've used elsewhere and it kind of fo…
Oddly, their password field is limited by size, but their username isn't. I have a 30 digit random character username.
Yes, but I'll bet that they'll give you the username if you know the Social Security number and birthday of the user. Sometimes they ask me for the address on the account.
Not like any of those things are hard to find.
Re: Schwab password policies and two factor authentication
#106I just called Schwab about this, and hand to whatever deity you believe in, this is what he told me: Representative: "One of the things we were trying to do with these passwords was make them different from other providers. So we know that they allow multiple character types, and are case-sensitive, so we decided to make them different. That way, you can't use the same password you've used elsewhere and it kind of fo…
This justification actually makes some sense to me (Software engineer familiar with crypto.) If an attacker already has access to the password hashes, then yes, they can brute force any 8 character case-insensitive password easily. However, a brute force "try to login to their site" attack isn't feasible without hitting a rate limit or alarm: (26+10)^8 = 2.8*10^12 is still a lot of attempts to login to an account. Th…
Why 8? IIRC it is now recommended to do 10-12 (at a minimum) and since it's autogenerated, might as well make it 20+chars if the site will accept it.
Also, you are assuming that Schwab rate-limits login attempts. Given their dismal password policy, do you think that's a safe/reasonable assumption?
Re: Schwab password policies and two factor authentication
#107I just called Schwab about this, and hand to whatever deity you believe in, this is what he told me: Representative: "One of the things we were trying to do with these passwords was make them different from other providers. So we know that they allow multiple character types, and are case-sensitive, so we decided to make them different. That way, you can't use the same password you've used elsewhere and it kind of fo…
This justification actually makes some sense to me (Software engineer familiar with crypto.) If an attacker already has access to the password hashes, then yes, they can brute force any 8 character case-insensitive password easily. However, a brute force "try to login to their site" attack isn't feasible without hitting a rate limit or alarm: (26+10)^8 = 2.8*10^12 is still a lot of attempts to login to an account. Th…
However, if you're forced to pick a unique password just for Schwab, it's immune from the most common [citation needed] attack on passwords. Also, it makes the Schwab password useless for hacking other databases, making user passwords a less valuable target for hackers.
I'll give you points for honesty on the [citation needed], but your entire argument hinges on this point and there's no a priori reason to follow your assumption.
Moreover, your idea of each website having a unique set of constraints to force unique passwords scales horribly from a user perspective.
10/10 for a devil's advocate answer.
Re: Schwab password policies and two factor authentication
#108I've been coming to an opinion on these issues that may be unpopular with the tech crowd: The big banks have the right idea when it comes to security, and we are misguided at best with our obsession over the minutia of password handling. Why? All of these big banks and investment houses have holdings in the neighborhood of billions of dollars. Like billions in actual cash. If they are so vulnerable and insecure, why…
A substantial volume of low-level fraud occurs every day and is baked into the cost of doing business because that costs less than reengineering fundamentally insecure systems.
A system where you can pull money by knowing a set of "secret" numbers shared with every entity an account holder has ever done business with is just insane to begin with.
We rely on reading transactions after the fact looking for red flags. You can beat the filters sometimes by running millions of credit cards. You can't really expect to move $100 billion from an investment bank to your checking account without anyone noticing and using their central authority to reverse the transaction.
Re: Schwab password policies and two factor authentication
#109I've been coming to an opinion on these issues that may be unpopular with the tech crowd: The big banks have the right idea when it comes to security, and we are misguided at best with our obsession over the minutia of password handling. Why? All of these big banks and investment houses have holdings in the neighborhood of billions of dollars. Like billions in actual cash. If they are so vulnerable and insecure, why…
JP Morgan got hit pretty hard. https://news.ycombinator.com/item?id=8403459
Hmm, looking at that, I'd say it more proves my point. At the top of their Wikipedia entry[0], it says that JPMorgan Chase has roughly 2.5 TRILLION in assets. According to this[1] site, 1.29 TRILLION in customer deposits. Hackers believed to be from Russia breached some of their systems and stole... drumroll please... customer names, addresses, phone numbers, and email addresses. There's stuff in there of value comparable to national economies, a mind-boggling amount of money, and they didn't get a penny of it. All they got was a glorified phone book.
Apple can't seem to protect their Apple IDs or iCloud data from determined attackers. Amazon and GoDaddy have given over total control of user's accounts to pretty simple social engineering attacks, both giving the attackers the keys to the castle. None of these attackers seem to have much in the way of funding or organization, and the stolen data doesn't seem to monetize terribly well. Do you think these companies would be able to keep trillions of dollars of their customers' money safe from attackers? Chase seems to be able to. Maybe the tech companies should take a few lessons from them.
[0] http://www.wikiwand.com/en/JPMorgan_Chase#/Financial_data
[1] http://www.marketwatch.com/investing/stock/jpm/financials/ba...
Re: Schwab password policies and two factor authentication
#110Online banking is largely a read-only proposition. It's mostly for reading account activity. Some of the more forward-looking banks will even let you initiate ACH transfers, but generally sending money to a new recipient triggers a 2FA prompt (debit card number prompt, phone call, text) and several secondary notifications, with several days to say "that wasn't me" before the money is gone.
I wouldn't voluntarily post my bank account credentials on the internet, but at the end of the day, the security of an online banking account just doesn't matter very much.
The security of the transaction mechanisms do, sure, but that's got little to do with online banking passwords.