My advice is to drop the bank now, after testing a replacement- there are plenty of smaller and "neo banks" looking to have your business with real development teams. I use the big, old and stogy bank of America but I have never had a complaint using desktop Linux and Firefox / chrome there.
Why not to whitelist operating system user agents
111–120 of 122 posts
Re: Why not to whitelist operating system user agents
#112I ran into a similar problem with the website of my general practitioner. It worked fine in all cases, except when using Firefox on Linux, which I use. After lots of testing and trying to contact whoever built the website I found that it blocked only user-agents which contained this literal string: X11; Ubuntu; Linux Only when that string was in there verbatim would it fail all requests with a 403 Forbidden. After I…
I host a few hundred wordpress sites and I recognise that string by sight! Tons of bots seem to use it. I haven’t 403’d it (yet) though.
[deleted]
Re: Why not to whitelist operating system user agents
#113Earlier quoted context omitted.
This is not straight incompetence though, as that config is not there by accident. It’s more in line with “screw that 1 per 1000 users”, for whatever reason. Malice might be too strong of a word, disdain could be closer to what we are seeing.
I would guess it was more in the line of not suspecting that it was a valid user-agent string; just one used by bots.
"No True Human..."
Re: Why not to whitelist operating system user agents
#114This is interesting to me. I actually left Chase a few years ago over a very similar issue: their statement PDFs would show up blank in all the PDF readers I tested. After contacting support and being told that the only option was for me to install the latest Adobe Acrobat Reader, I told them to close my account.
I never even thought about the accessibility requirements. I am sure that relying on PDF features that only the latest Acrobat supports hurts a lot of people on that front too (unless Acrobat happens to be the most accessible of readers?)
Re: Why not to whitelist operating system user agents
#115Earlier quoted context omitted.
This is not straight incompetence though, as that config is not there by accident. It’s more in line with “screw that 1 per 1000 users”, for whatever reason. Malice might be too strong of a word, disdain could be closer to what we are seeing.
I would guess it was more in the line of not suspecting that it was a valid user-agent string; just one used by bots.
Not even checking what matches that user-agent would be a deeper level of “screw it”. You’d google what you’re banning before banning it.
Re: Why not to whitelist operating system user agents
#116Earlier quoted context omitted.
platform.js 1.3.1 is in there ( https://github.com/bestiejs/platform.js/ ) I see this from the pretty-printed version function a() { return /Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(navigator.userAgent) ? "Device" : "Desktop" } So let's try to just say I'm say, Opera Mini, still no dice. I tried a bunhch of these to no avail. I don't know how the OP got this.
Well that kind of matches the message he received from the website. It looks like they are just trying to notify you that there is a Chase Mobile App available (which for the average phone user, would be 99.9999% better than using a browser). Personally I wouldn't use a phone for banking but some people don't have laptops/desktops.
> Personally I wouldn't use a phone for banking
Using your bank's mobile webapp is very useful when they, for some god awful reason, decide to use SafetyNet.
Re: Why not to whitelist operating system user agents
#117Banks do stuff like this all the time - they are always the long tail of security - could be a topic in itself. I contemplated this for a very long time and decided that JP Morgan would rather take the hit for bad security then pay wages and benefits to support people to deal with password resets, lost yubikeys, etc. No other answer makes sense. My advise to OP is to dump Chase, Citibank, Bank Of America, ASAP. Move…
Any suggestions?
Get a schwab account. No fees, fee ATM worldwide, and TOTP.
Re: Why not to whitelist operating system user agents
#118Earlier quoted context omitted.
If you're in the US, call your doc and mention that this may be a violation of the 21st Century Cures Act, as it is preventing or interfering with the access, exchange, or use of electronic health information. It would be a stretch to call this an outright violation (as they could satisfy the requirement by printing the information you want and mailing it to you...), but it's a trendy topic in healthcare right now, s…
> call your doc and mention that this may be a violation of the 21st Century Cures Act Unless you’re a lawyer, don’t do this. Empty threats are more frequently sorted into the crackpot category than the kind one responds to.
More realistically, they’ll refer you to their lawyer.
Re: Why not to whitelist operating system user agents
#119Earlier quoted context omitted.
Try Spanish online digital administration. The digital certificates only worked in IE. And mid-process they require installing a Java-based program that required a different type of digital certificate. That of course make you restart the browser and lose all the data entered. Just wow. I couldn't even come up with such a bad process if I wanted.
Not sure if you're referring to something old, I've only been in Spain since 2012 but I'm having zero issues with the digital certificate for various government websites, from hacienda to local city governments websites. Never have I been forced to install Java either. I usually use Firefox on Linux and seems to work fine, at least for me.
It was just yesterday. To sign in you need @clave, but to actually sign the document, you need AutoFirma, that's the java-based tool.
Re: Why not to whitelist operating system user agents
#120Try Japanese business banking - where you have to pick an OS and stick with it when registering (with a paper form), and must use either the ESR release of Firefox or Internet Explorer. If you don't have a user agent of either of those it won't even let you sign in.
Try Spanish online digital administration. The digital certificates only worked in IE. And mid-process they require installing a Java-based program that required a different type of digital certificate. That of course make you restart the browser and lose all the data entered. Just wow. I couldn't even come up with such a bad process if I wanted.
Oh boy are you wrong. We Spanish people love trash talking our own country, but after 3 years in Japan, I can tell you that the Spanish banks and bureaucracy are light-years ahead of Japan.
At least in Spain we have online administration, even if it's not perfect. Here? Hand written forms, hankos and fax machines. Everything is at least ten times as difficult as it should be.