South African bank advises against the use of password managers • Hacker News Board

Re: South African bank advises against the use of password managers

#71

Post by vxNsr » Mon, Aug 19, 2019, 7:28 PM UTC

0xffff2 wrote: post #67

moviuro wrote: post #56

Earlier quoted context omitted.

That's not true about Paypal though: "Use lower case, upper case, a number, and a special character [like ~!@#$%^&*()_+=?> And even if the character subset is quite small (26 lower case, 26 upper case, 10 digits), it's still good enough if it's completely random and never leaked once. Just max out the password length (start at 32 char) and back track from there. [0] https://www.paypal.com/us/smarthelp/article/Tips-fo…

I find this to be a recurring theme when banking security comes up. Every time I've ever been in a position to check, the specific claims made by HN comments about lackluster bank security practices have not been true. I assume they must have been true at one point, but commenters don't check that they are still true before commenting.

It was true in 2016 when I created my account. it was also true about BoA, they allowed a limited char-set.

Re: South African bank advises against the use of password managers

#72

Post by vxNsr » Mon, Aug 19, 2019, 7:29 PM UTC

moviuro wrote: post #56

vxNsr wrote: post #32

Earlier quoted context omitted.

The most confusing thing is that a lot of banks (paypal included) still don't let you use "special chars" in your password. Or they will allow it but only for a very limited set that they don't tell you.

That's not true about Paypal though: "Use lower case, upper case, a number, and a special character [like ~!@#$%^&*()_+=?> And even if the character subset is quite small (26 lower case, 26 upper case, 10 digits), it's still good enough if it's completely random and never leaked once. Just max out the password length (start at 32 char) and back track from there. [0] https://www.paypal.com/us/smarthelp/article/Tips-fo…

That doc isn't dated, but it was true as recently as three years ago.

Re: South African bank advises against the use of password managers

#73

Post by zxcvbn4038 » Mon, Aug 19, 2019, 7:43 PM UTC

Over the weekend I had to call Time Warner Cable for support. Their support representative was willing to send an e-mail verification to any address I provided - in fact she refused to send an e-mail to the address on file because she couldn’t be sure the address was valid or who she was sending too. All this when I accessed a live chat feature from within a logged in context where I had already authenticated myself.

Re: South African bank advises against the use of password managers

#74

Post by zxcvbn4038 » Mon, Aug 19, 2019, 7:55 PM UTC

vxNsr wrote: post #32

mikeash wrote: post #5

“Bank has idiotic ideas about security” is as surprising as “sun rises at predicted time.” Something about the industry seems to push paranoid incompetence in security.

The most confusing thing is that a lot of banks (paypal included) still don't let you use "special chars" in your password. Or they will allow it but only for a very limited set that they don't tell you.

I was super impressed to find that PayPal supports TOTP now, as the the brokerage Robinhood. Everyone else is still doing proprietary tokens, sms, or good looks for MFA. Tumblr had TOTP first but go PayPal, they get a pat on the back for doing something right.

Re: South African bank advises against the use of password managers

#75

Post by Cytobit » Tue, Aug 20, 2019, 8:18 PM UTC

mcv wrote: post #6

I'm frequently baffled when I encounter a login form that doesn't allow pasting a password. Of course with developer tools I can just remove the attribute that causes that, but plenty of internet users lack that level of technical knowledge and are forced to resort to easy to member and very likely reused passwords. I feel like this is a similar red flag as the 'no single quotes in passwords' limitation that used to…

Sometimes using Shift+Insert instead of Ctrl+V can allow you to paste into these fields.