Why are banks still getting authentication so wrong?

Post by joquarky » Wed, May 14, 2025, 7:55 PM UTC

crazygringo wrote: post #249

wodenokoto wrote: post #45

Earlier quoted context omitted.

When calling my bank I have to enter my entire CC number AND my PIN code. Talk about training people to give away sensitive data.

What is the issue? That's literally just your account number and the password. That's what you're supposed to do. That's what security is. That's the sensitive data that ensures it's not a rando calling who stole your card. I'm not sure what alternative you are looking for? You're the one calling them, so it's fine.

Post by lurking_swe » Wed, May 14, 2025, 8:07 PM UTC

aspenmayer wrote: post #315

lurking_swe wrote: post #311

Earlier quoted context omitted.

> I don’t have a good way to authenticate someone is calling from the bank on my end. You could ask them to list your last 3 transactions, and their exact amounts. Easy to cross-reference by looking at your banking website / app.

Unless the system you use the check that balance is compromised on your end or their end. If you have malware, they can be looking at the same numbers you’re looking at, so that isn’t fool-proof. If your account is already compromised, they may just be phishing for 2fa tokens to initiate some kind of account change, like the kind that would complete their total account takeover, at least until you or the bank notices…

Post by hamburglar » Wed, May 14, 2025, 10:17 PM UTC

viridian wrote: post #358

hamburglar wrote: post #280

Earlier quoted context omitted.

I think it’s valid to question the wisdom of a CISO using misguided password guidelines. I don’t think it’s valid to respond to guidelines you disagree with by willfully sabatoging security. You relinquish your righteous position on password security when you put your password on a post-it in your laptop.

Reads like you are trying to argue for abstinence only education here. The reality security must operate in is that the best security policies are those that people don't circumvent. If people have to resort to sticky notes, sharing credentials, scripts that automatically update a file containing a plaintext credential, or what have you, odds are that security has massively fumbled the ball. Keep in mind this is alre…

Post by spjt » Thu, May 15, 2025, 2:02 AM UTC

Geebs wrote: post #25

kokonoko wrote: post #16

Can we get rid of the password expiration too? Requiring that users change their perfectly secure password every 6 months is absurd and gives the impression of security when in reality it only makes things worse.

One hundred percent. I’d be interested to see how many people resort to having weaker passwords just to try to remember the new password every 6 months. I know many folks are proud of their password ‘system’ of using the same word and adding different numbers every time they need to change it. Not helpful.

Post by azophy_2 » Thu, May 15, 2025, 5:44 AM UTC

seri4l wrote: post #308

homebrewer wrote: post #293

Earlier quoted context omitted.

Be careful what you wish for. This problem is solved in China — you can contact many government agencies and major companies over WeChat and be sure that you're talking to the real entity, but the downside is that WeChat has a copy of your passport and knows everything about you.

>This problem is solved in China It isn't. China is the best example that draconian identity verification / KYC processes don't stop scammers.