Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your Mother’s Maiden Name Is Not a Secret

nytimes.com

Post reply on HN
Print view View original

91–100 of 274 posts

Re: Your Mother’s Maiden Name Is Not a Secret

#91

Post by u801e »

What banks should really do instead of just using passwords or 2-factor authentication is to use client TLS certificates in addition to the standard username and password.

The bank can advertise instructions on how to generate a certificate signing request, have you bring it in when you open an account, have the bank issue you a client certificate and have them give you instructions on how to import it into your web browser. The bank can also tell you to do this for each device you plan to use to access your online account(s).

Re: Your Mother’s Maiden Name Is Not a Secret

#93

Post by visarga »

germanier wrote: post #77
Aardwolf wrote: post #14

Earlier quoted context omitted.

Oh european banks also like to keep the money for a day. Other than that day of interest it's free though :) no 25 dollar wiring fee as seen in US

Is it still that slow? Since a few months 95% of my transactions between Germany, the Netherlands and the UK (EUR account) happen the same day. It's not like banks actually can earn interest right now anyway. If anything it costs them to hold money currently.

It probably happens same day only if you send the transfer early in the morning.

Re: Your Mother’s Maiden Name Is Not a Secret

#94

Post by billfruit »

shas3 wrote: post #38
Aardwolf wrote: post #4

Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…

Wow exactly the situation in india! We’ve had 2FA, mobile alerts, etc. ever since the dawn of the Internet banking in late 90s. Wasn’t so in the US even as recently as 2010.

But in other respects things are stuck in the past in India too, like your account being tightly coupled to a particular branch of the bank, and many commercial establishments charging extra for card transactions.

Re: Your Mother’s Maiden Name Is Not a Secret

#95

Post by jacobolus »

doomlaser wrote: post #80
ChemicalWarfare wrote: post #67

Earlier quoted context omitted.

>> but has a delay for clearing... not only is there an ODFI-clearing house - RDFI delay caused by the actual "clearing" process - the whole flow starting from the merchant->payment processor step is a sequence of nightly batches with cutoff times factored in to boot. from the merchant perspective, however, ACH payment is cheaper to process than a credit card payment and is way less likely to end up in a chargeback.

debit card transactions are all ACH then?

No. ACH is the digital equivalent of depositing a paper check. The debit networks are what you use to withdraw money from an ATM, and require entering a PIN, but most debit cards nowadays can also operate through credit card networks.

Re: Your Mother’s Maiden Name Is Not a Secret

#96

Post by chrismcb »

Latty wrote: post #79
nicc wrote: post #9

My bank (Fineco) requires passwords to be 8 characters. Yup, I don't mean minimum or maximum, but exactly 8 characters. That's got to make brute-forcing about 1,000,000 times easier, and I cannot think of a single good reason to impose this. I bet huge numbers are "12345678" and "password".

> I cannot think of a single good reason to impose this. Good? Definitely not, but my money is on CHAR(8) and a lack of understanding.

> lack of understanding That is the thing... Id the programs and designers lack understanding of something as basic as passwords what else are they misunderstanding? Sql injection? My other favorite is "use only the special characters...."

Re: Your Mother’s Maiden Name Is Not a Secret

#97

Post by motherdearest »

u801e wrote: post #91

What banks should really do instead of just using passwords or 2-factor authentication is to use client TLS certificates in addition to the standard username and password. The bank can advertise instructions on how to generate a certificate signing request, have you bring it in when you open an account, have the bank issue you a client certificate and have them give you instructions on how to import it into your web…

I can just imagine my mother getting flustered after reading the words "certificate signing (sic?) Request" and stop reading at "client certificate". I can think of very elaborate security measures. The trick is to make them sound easy and relatable to a ranch hand and 1960s housewife. These people smart but they don't have the same life experiences

Re: Your Mother’s Maiden Name Is Not a Secret

#98

Post by ChemicalWarfare »

doomlaser wrote: post #80
ChemicalWarfare wrote: post #67

Earlier quoted context omitted.

>> but has a delay for clearing... not only is there an ODFI-clearing house - RDFI delay caused by the actual "clearing" process - the whole flow starting from the merchant->payment processor step is a sequence of nightly batches with cutoff times factored in to boot. from the merchant perspective, however, ACH payment is cheaper to process than a credit card payment and is way less likely to end up in a chargeback.

debit card transactions are all ACH then?

debit cards(not to be confused with bank cards) are closer to credit cards than ACH. in some cases - for example "signature debit" vs "pin debit" - just about identical from the flow perspective.

which is why you can use debit cards in most situations where you would use a credit card where instant check of funds availability and hold is required - e.g. hotel incidentals etc.

Re: Your Mother’s Maiden Name Is Not a Secret

#99

Post by ljk »

Aardwolf wrote: post #4

Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…

> 2nd factor authentication

unless your phone is compromised

Re: Your Mother’s Maiden Name Is Not a Secret

#100

Post by motherdearest »

yawaramin wrote: post #53
jjeaff wrote: post #44

Earlier quoted context omitted.

That may work in cases of online password resets, but I believe it has been demonstrated that they are not great for social engineering reasons. A hacker can just say, "oh I just mashed the keyboard for that" or worse, the agent thinks it is an error or glitch and let's the hacker in. I think best to use a real, but different last name on all your sites.

Do most websites have call centres where you can try to trick agents? Also, how gullible are call centre agents at financial institutions? If they're really giving out access to random people claiming to have forgotten the security answer, it's pretty clear-cut the bank should be on the hook for damages if money gets stolen. Nothing like the prospect of having to pay out damages for gullible call centre agents to mot…

Additionally many institution's gaurd against this by having systems that hide the security question from the customer service representative and only authenticate on a correct answer. If they are showing the "secret questions" to their entire customer service department you don't even need to worry about outside attacks because your organization is ripe from the inside
Post reply on HN