What Is Your Bank’s Security Banking On?

Re:What Is Your Bank’s Security Banking On? by zaarn on Wednesday March 07, 2018 @05:55AM (#16535604)

The security of my bank is pretty good, any account management action (password reset, card pin change, mailing address, email, name, etc.) requires physical presence in the closest branch. Not any arbitrary branch, the closest. With my passport. Not some bill or mail on my address. My passport.

The password reset will then setup a new password with 12 characters, number and specials included. This password is then sent via german postal service to my house, I can't pick it up on my local branch or have it told to me. Send via mail. Period.

The letter advices me to change the password to something secure immediately and destroy the letter securely afterwards. The banking website enforces this and you cannot change your password to any temporary password that your account previously had. (So if someone intercepted the letter, you would either notice or it would be useless)

The only downside is they have an ancient COBOL mainframe doing the accounts, so they're case insensitive and encoded in ECBDIC, although they are properly hashed using bcrypt, there is an upper limit of 24 characters because it still passes through there.

So I would say my bank is banking on the customer picking a good enough password and hoping they can replace the COBOL mainframe at some point.

[ Parent | on HN ]

Re:What Is Your Bank’s Security Banking On? by mikeash on Wednesday March 07, 2018 @09:42AM (#16536663)

Requiring a physical presence at a single branch doesn’t sound like good security to me. It does sound effective at preventing unauthorized access, but good security must also be good about allowing authorized access. Otherwise, the best bank security would involve encasing your money in concrete and sinking it to the bottom of the ocean.

[ Parent | on HN ]

Re:What Is Your Bank’s Security Banking On? by zaarn on Wednesday March 07, 2018 @09:47AM (#16536705)

It's not a very long date, you show up, show passport/id-card and they'll authorize you getting a new password send. And while you're there you can write out any SEPA transactions you need done onto paper and submit manually (almost any bank still has a special mailbox for manual submission).

[ Parent | on HN ]

Re:What Is Your Bank’s Security Banking On? by astura on Wednesday March 07, 2018 @11:28AM (#16537463)

And if you're out of town or you work during banking hours?

[ Parent | on HN ]

Re:What Is Your Bank’s Security Banking On? by zaarn on Thursday March 08, 2018 @02:45AM (#16542973)

I work out of town during banking hours and I've managed to squeeze out the 10 minutes it takes to show up and request the reset.

[ Parent | on HN ]

Re:What Is Your Bank’s Security Banking On? by tolle on Wednesday March 07, 2018 @06:18AM (#16535678)

They could just swap out the authentication mechanism instead of the entire COBOL stack. I don't really know why you wouldn't just run the auth bits in some other language. The programs that calculate your monthly interest on your mortgage doesn't exactly have to have to be able to handle your login credentials.

[ Parent | on HN ]

Re:What Is Your Bank’s Security Banking On? by zaarn on Wednesday March 07, 2018 @06:37AM (#16535750)

AFAIK it's because their entire system is rather legacy, so over the years they tacked on fixes while "the replacement will be done soon(TM)".

Banks do have some problem with these sorts of projects, so I think they're trying to build something that will last as long as the COBOL system at less cost.

[ Parent | on HN ]