31–39 of 39 posts
How many times do people talk about their bank in glowing terms? How many people love their bank? How many people rave about their bank? I have never met anyone that would meet those descriptions. I think those are telltale signs that there is room for a Zappos of banks. I hope www.simple.com can be it. I wish www.mint.com had gone for it.
Systems exist (just not in the US). My provider (ABN Amro in Holland) works like this: 1. Login is your account number and card number (1234567 + 004, located on card) 2. Password is generated by putting your 'smart' card into a little device, typing a PIN in, and typing in the resulting one-time pass. Other banks do this by sending the code via SMS, which is also good (though a bit less secure). 3. Interface is not…
So it's secure, works in all browsers, and gives you choice in how you want to log on. And on top of that, the actual service is great, paying bills is easy and free, opening accounts and moving money between accounts is instant and free, transferring to other banks or other people is free (but takes time), automatic bill payment is easy and free.
And the other banks in my country aren't bad either, competition forces all of them to be secure, free to use, and easy to use.
Sorry, but I have to disagree with many of your suggestions. 1. Log in from the home page: This would require the bank to serve its home page from https, including a redirect from http for every visitor, in case he or she wants to log in. 2. 4-digit passcodes: You're missing the key point about your ATM login -- it's only secure because it combines something you have (your ATM card) with something you know (your PIN)…
3. You might get some tiny fraction of additional security (through obscurity) by obfuscating people's logins, but this is ridiculous, unnecessary, and at great expense to the user experience when a decent password provides all the security you need.
How many times do people talk about their bank in glowing terms? How many people love their bank? How many people rave about their bank? I have never met anyone that would meet those descriptions. I think those are telltale signs that there is room for a Zappos of banks. I hope www.simple.com can be it. I wish www.mint.com had gone for it.
- don't have silly password restrictions (login is username + password 1 + 3* n'th letter from password 2, transfers need password 1 again, large transfers to unknown destination needs phone confirmation (automatic service))
- have website working well in pretty much any browser
- provide instant SMS notification about low balance and an account summary every week
- have pretty low waiting times (whenever I call, it's rarely more than a minute before my call is picked up)
- process my statement and split known records into groups showing me money spent/earned from various sources (car, house, food expenses, etc.); they find recurring payments and put them into a calendar which gives a good idea of how much money I need and when; effectively they killed the need of using local app for keeping track of my account
- they provide exports into csv and other formats (although they've got a "known issue" for years where the export range is approximate - it can add or miss a couple of days randomly)
- they do watch my account - when my employer missed the payday by 1 day, I got a call to check if that's expected; when I got a larger incoming transfer, I also got a call to notify me about it and check if it's expected (did not request that before)
I do recommend them to other people, because they're better than other banks I had to deal with.
Most British banks require two-factor authentication. My bank (Barclays) allows me to login without sending a password over the wire. I insert my debit card into a reader and enter my normal PIN, which generates a one-time password. The scheme is remarkably well-designed and defeats all of the usual attacks[1]. Crucially, I must generate a different one-time password using a different procedure if I wish to transfer…
Sorry, but I have to disagree with many of your suggestions. 1. Log in from the home page: This would require the bank to serve its home page from https, including a redirect from http for every visitor, in case he or she wants to log in. 2. 4-digit passcodes: You're missing the key point about your ATM login -- it's only secure because it combines something you have (your ATM card) with something you know (your PIN)…
1. All email providers do the HTTPS thing. Have you noticed any problem with them? Almost every user who visits the bank's website will want to log in. 3. You might get some tiny fraction of additional security (through obscurity) by obfuscating people's logins, but this is ridiculous, unnecessary, and at great expense to the user experience when a decent password provides all the security you need.
Yes, email providers allow you to log in from their front page, but even then only from their gateway page. As a good example, www.yahoo.com does NOT have a login for their webmail client -- you have to click through to a separate screen. You only see the login if you go directly to mail.yahoo.com.
Most British banks require two-factor authentication. My bank (Barclays) allows me to login without sending a password over the wire. I insert my debit card into a reader and enter my normal PIN, which generates a one-time password. The scheme is remarkably well-designed and defeats all of the usual attacks[1]. Crucially, I must generate a different one-time password using a different procedure if I wish to transfer…
Account access requires a keypad widget, an account number, the widget's serial number, a pin and the generated one-time pass.
Any transactions require a second one-time pass derived from a different algo.
How many times do people talk about their bank in glowing terms? How many people love their bank? How many people rave about their bank? I have never met anyone that would meet those descriptions. I think those are telltale signs that there is room for a Zappos of banks. I hope www.simple.com can be it. I wish www.mint.com had gone for it.
I'm feel pretty good with Lloyds (UK). While they're not perfect, they: - don't have silly password restrictions (login is username + password 1 + 3* n'th letter from password 2, transfers need password 1 again, large transfers to unknown destination needs phone confirmation (automatic service)) - have website working well in pretty much any browser - provide instant SMS notification about low balance and an account…