Why Canada’s banks have weaker passwords than Twitter or Google

Re:Why Canada’s banks have weaker passwords than Twitter or ... by ufmace on Sunday June 08, 2014 @01:17PM (#7865220)

The funny thing about this issue is that while many banks have ridiculously bad authentication systems from a network security point of view, they generally seem to suffer almost no negative consequences from it, as far as people actually getting hacked and losing money. Perhaps it's the level of secondary checks in their systems making it tough to actually monetize a hacked account without leading the law straight to your door.

Maybe there's a lesson here - a broader approach to security, like implementing checks at every level of operation to make sure nothing bad happens even if an attacker is deep into the system, is better than a singular focus on password length and other login details.

[ Parent | on HN ]

Re:Why Canada’s banks have weaker passwords than Twitter or ... by FigBug on Sunday June 08, 2014 @02:20PM (#7865386)

I think you are correct. Even with a hacked account, it's very difficult to move the money into another account without leaving a trail. Either the money will have a hold for days or the transaction can be reversed.

There are also consequences, steal money and you'll probably go to jail. Hack somebodies email, law enforcement probably won't do anything unless it's a high profile case.

Compare to BitCoin. Irreversible anonymous transactions. Far better security and coins are constantly getting stolen. I really don't think BitCoin will succeed since computer security in general is still kinda amateur hour.

[ Parent | on HN ]

Re:Why Canada’s banks have weaker passwords than Twitter or ... by brazzy on Sunday June 08, 2014 @02:29PM (#7865410)

> making it tough to actually monetize a hacked account without leading the law straight to your door.

Nope, monetizing a hacked account without doing that is trivial (at least here in Europe where money transfers are an everyday occurrence for everyone and few people remember what a "check" is):

Send out spam promising a way to make $$$ from home without qualifications as a "financial agent". Transfer money from hacked accounts to the gullible, desperate schmucks who respond, tell them they can keep 10% as commission and have to transfer the rest via Western Union to someone in Russia.

> Maybe there's a lesson here - a broader approach to security

Defense in depth, should be a widely-known concept by now.

[ Parent | on HN ]

Re:Why Canada’s banks have weaker passwords than Twitter or ... by dhekir on Sunday June 08, 2014 @02:41PM (#7865445)

Indeed, a multi-layered approach, while more expensive, provides some advantages. It is also interesting to compare this system to the one applied in countries where security is more of an issue.

In Brazil, for instance, where hackers get quite creative, some non-business accounts offer 2FA via authenticators.

Some banks even require you to install some "security" Windows software before enabling you to use your home computer. Needless to say, such software is not always easy to remove (as most trojans). I'm not sure how it would work on a Linux (if it would work at all).

And sometimes they also limit online transfers to ridiculously low amounts (e.g. 100$/day).

Despite all that, they only allowed numeric passwords for the online system, consisting of 8 digits (chosen by the user) + 3 characters (chosen by the system). I believe this is to ensure the same password can be used in ATMs as well.

[ Parent | on HN ]