Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My bank keeps on undermining anti-phishing education

moritz-mander.de

Post reply on HN
Print view View original

131–140 of 267 posts

Re: My bank keeps on undermining anti-phishing education

#131

Post by Tade0 »

meindnoch wrote: post #39

My bank used to call me with random marketing crap, and insisted on telling them my birthday and my mother's name before they can reveal their latest exclusive offer or some other crap. They were always dumbfounded when I retorted that it is them who need to prove that they're really calling from my bank first.

My bank eventually understood this, which is why currently you can check in the app whether on their end they're seeing that you're talking with their sales rep and which one specifically.

Re: My bank keeps on undermining anti-phishing education

#132

Post by GolDDranks »

BobAliceInATree wrote: post #74
massung wrote: post #60

I use USAA for banking. Something they do when they initiate a call to me on the phone is they start by making sure they are talking to me (they don’t ask me to prove it) and making sure I have the app on the my phone or access to a web page. Then they initiate a MFA check within the app. I have to get it and read back a number. Then they ask me for my phone PIN or password. Once that’s done, then we can start talkin…

You're giving a MFA number to someone that called you?!

The bank I used to use had a per-verification request code that the app showed. If the party dealing with you knew the code, you could be sure they were the party who initiated the verification request.

Re: My bank keeps on undermining anti-phishing education

#133

Post by GuB-42 »

vladvasiliu wrote: post #13
0x5FC3 wrote: post #4

User facing tech and marketing practices at banks are the worst. Every Indian bank login form I've ever had to use is - hostile to password managers. - You cannot copy paste passwords. - Client side password hashing - Stupid requirements like the password cannot have more than 15 characters and even have a whitelist of character sets! (Looking at you HDFC) - And of course, run of the mill spam They are all stuck in t…

> cannot have more than 15 characters That's something! My bank insists on exactly 6 numbers. Not characters, numbers. They're also hostile to password managers and don't allow copy/paste. You have to click on the numbers with your mouse. "My security" is very important to them, so they've moved 2nd factor from a physical fob, to an app tied to my phone, and now they've improved it further by switching to sms! Now, t…

As I understand it, the thing with "click the number" codes is that it is a protection against keyloggers. The numbers are usually scrambled and when you click on it, you don't send the code but the position of the numbers you clicked. So for someone to get your code, you need both a screen capture and the position of mouse clicks.

So 6 digits is low entropy, but it is compensated by a few layers of security. I don't know in practice how effective it is against passwords. I have seen it done in several banks, insurance companies, etc... including online banks. So I guess that it is not that bad. Most discourage SMS/email second factor in favor of their apps though. The physical fob is probably a hassle for them so they will try to push you to other solutions, usually an app.

Re: My bank keeps on undermining anti-phishing education

#134

Post by unethical_ban »

kakuri wrote: post #121
RandomBacon wrote: post #9

My bank has implemented suggestions I've given them in the past (USAA), but recently they used a different domain for a legitimate-seeming email (the email was about something I just did, and it was to an address I only use with that bank ), and I called them up and spoke with someone in their fraud department to ask about it. I told them either they were hacked, or they were training their customers to fall for phis…

I interviewed for a software engineering position at USAA. After seeing the incompetence of the interviewers none of the nonsense they do surprises me.

I worked in IT ops there for a long time, and since then have seen the inner workings of companies in several different fields.

They had by far the most competent cybersecurity group I've witnessed. Things have changed in a decade maybe.

But, they still use proprietary TOTP from Symantec which is annoying.

Re: My bank keeps on undermining anti-phishing education

#136

Post by jszymborski »

Royal Bank of Canada hasn't done anything this egregious but it always gave me a lot of confusion.

They use so many different domains. I'm not talking about redirects either. Like their landing page is at rbcroyalbank.com and then the login is at secure.royalbank.com. for ages rbc.com was another website for ages, but now also appears to be the Royal Bank (or is it?). I forget under which domain the dashboard is hosted.

Like, I get buying all the variations of your bank name, but please just redirect to one cannonical one! Marketing should also be for one domain. Way to easy to be scammed by royalbankofcanada. com or rbcbank.ca, because who the heck knows what their actual site is!

Re: My bank keeps on undermining anti-phishing education

#137

Post by jszymborski »

vladvasiliu wrote: post #13
0x5FC3 wrote: post #4

User facing tech and marketing practices at banks are the worst. Every Indian bank login form I've ever had to use is - hostile to password managers. - You cannot copy paste passwords. - Client side password hashing - Stupid requirements like the password cannot have more than 15 characters and even have a whitelist of character sets! (Looking at you HDFC) - And of course, run of the mill spam They are all stuck in t…

> cannot have more than 15 characters That's something! My bank insists on exactly 6 numbers. Not characters, numbers. They're also hostile to password managers and don't allow copy/paste. You have to click on the numbers with your mouse. "My security" is very important to them, so they've moved 2nd factor from a physical fob, to an app tied to my phone, and now they've improved it further by switching to sms! Now, t…

Royal Bank of Canada (at least until recently, haven't been a customer for a while) just silently truncates your password. Discovered this when I thought I saw the number of masked characters go down, and then entered my password with one less character and logged in. (This was on mobile)

Re: My bank keeps on undermining anti-phishing education

#138

Post by BobaFloutist »

everdrive wrote: post #109

Phising and phishing education are inherently misguided. If my normal workflow includes much the following, then phishing will always eventually succeed: - HTML emails where links and remote images obfuscate the 'real' content of the email. - URLs which are not clearly and easily human-readable. - A workflow where my normal and expected daily behavior is to receive valid emails that I don't recognizes with URLs from…

Sharepoint is crazy. I get an email sending me documents, but to view them I need to click a link to an outside website and enter in my email login details??

Re: My bank keeps on undermining anti-phishing education

#139

Post by freedomben »

OkayPhysicist wrote: post #112
microtonal wrote: post #63

Earlier quoted context omitted.

One of my former banks handled this pretty well. They called you and would say something like “there is an issue, but since you should never trust a direct phone call pretending to be your bank, please look up our number on our website and call us”. It’s kinda nice because while doing this, they also educate their customers to never trust such a call and to rely on official information to contact them.

My credit union does the same but with "call the number on the back of your card". I suppose they have a lot of practice getting it right, given that their idea of a suspicious transaction is any transaction out of state.

My bank did the "out of state" suspicious thing for a while. It was particularly painful since I lived near a state border...

Re: My bank keeps on undermining anti-phishing education

#140

Post by RandomBacon »

andrewmcwatters wrote: post #120
mitthrowaway2 wrote: post #66

This is pretty bad, but not as bad as Plaid asking for my bank account log-in credentials.

There’s no other way to do it. Not all banks expose an API.

> There’s no other way to do it.

Don't they allow you to manually enter the bank routing number and account number, then verify it by depositing and withdrawing a few cents?

Post reply on HN