Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The guys who made the security for my country's state bank are completely nuts in all senses. Their internet banking password must be between 8 and 10 characters, and contain only letters and digits.
I don't think I need to stress how insanely backwards such restrictions are.

In another news, my card's password must be exactly 4 numbers. I'm pretty sure most passwords are an year, and quite possibly an year between the first half of the past century and the current.

Meanwhile, my e-mail password has... 35 characters.

The only non-public thing needed to set up the online banking account is to have that 4-number password. It's also used in their ATMs along with a 3-syllable case-insensitive password that the bank gives you. I guess they realised their passwords were weak, so they thought, "hey, let's top that up with another insecure password".

Speaking of ATMs, they run some Windows version that I believe to be between 9x and 2k, whose desktop I saw in a ATM whose software seemed to have suffered a buffer overflow (there was a command prompt window open). This doesn't reassure me that they take security seriously.

So the question is:

When asked for a weak password, in the sense that the character set and count is limited, what do you do?

I considered hashing my current password, but it would be a nuisance to generate the hash all the time. My current solution involves applying a rememberable algorithm to the aforementioned 35-character password that I use in my e-mail.


Edit: even though an answer has been accepted, you're welcome to share your thoughts.

share|improve this question
    
Oh, and they think that using mangled titles ("iNterNeT...bAN.King") in their website helps protect against keyloggers. They're not the only bank that does this. –  Camilo Martin Mar 20 '12 at 5:16
    
The username I choose also needs to be between 10 and 20 characters (yes the username may/must be twice longer than the password) and contain numbers. It's the first time I see such restriction on an username. –  Camilo Martin Mar 20 '12 at 5:19
1  
The limitation on PIN-codes for the card itself is not so worse. Oftewn cards get blocked after 3 or so attempts, one needs to have the card, and it requires interaction with a terminal, which makes it more auditable. The web application is, however weak -- actually password authentication for such a thing is weak, of the banks I know (Dutch) all use some sort of external (trusted) device for authentication purposes. The best solution is making the most of it -- choosing the best password possible -- and often look at your statements for strange things, I'd guess. –  Legolas Mar 20 '12 at 6:56
1  
I've tried summing up the discussion in an answer. Feel free to comment, as I am not completely sure if this is the answer you are looking for. –  Legolas Mar 20 '12 at 11:19
1  
"between 8 and 10 characters, and contain only letters and digits." That's pretty secure if you choose them randomly. 51bits if you assume 26 letters, 59bits if you assume 52 letters. –  CodesInChaos Mar 20 '12 at 17:35

3 Answers 3

up vote 6 down vote accepted

As discussed in the comments section, password based security is very minimal for banking, as it is worth the effort for a thief to try to steal your password. They basically only have to infiltrate your browser and log your entries. Furthermore, if this is achieved, they have full access.

Approaches such as hashing or other algorithms do not really matter, as you still will be typing in a password that has to commit to the set limits. Thus, you are really only making it harder to remember for yourself, but someone trying to bruteforce -- although it still is a lot of characters for bruteforcing -- still has to do the same effort.

We also discussed other approaches, such as security tokens -- which I personally prefer -- and SMS-based one time passwords. The idea of the former being that you must have your card at hand, and use this to set a signature. However, most non-connected implementations work by signing a number (hash) that most users cannot relate to the action that is about to take place, so a smart attacker may try to fool you by changing the numbers on the screen and the actual numbers. This is where the connected token comes in, which uses its display to show you the complete action you are about to allow, which is probably the most usable secure method out there at the moment. However, I have no idea on banks supporting these techniques in your region.

Finally, with banking security, auditing is most important. Check your statements for crazy transactions and report those as soon as possible. This still is the best approach to banking security. Recall, for example, that credit card fraud is not so hard, but recalling transaction is not hard either.

share|improve this answer
1  
Even though I think the average security-conscious person (such as probably everyone here) is a very hard target already, I concur banks should provide and recommend better security options. Regarding key-logging, it's probably not as easy, since most banks use virtual keyboards (but still possible). You rightly point out that the obligation of having your card at hand is the most secure of all approaches, but I really think the bank should allow users to opt-out of this, since they may find this cumbersome (so I think it's up to the user to sacrifice security for convenience). +1/accepted. –  Camilo Martin Mar 20 '12 at 15:17
    
I'll comment about what I plan to do, since beyond what has been said it's pretty much speculation (if a site forces weak schemes on us, we're screwed anyway). If I'm at home, since I trust my home computer, I'll just use it as normal. My password is at least a hard one to crack, even at 10 alpha-numeric characters. In a computer which is not mine, but that is trustable enough as not to have a hardware rootkit, I'd use a Linux live CD. Beyond this, I'll turn on SMS reporting of transactions (so I don't have to be checking for them periodically). Most banks support this I think (this one does). –  Camilo Martin Mar 20 '12 at 15:23
1  
@CamiloMartin I fear that virtual keyboard add (almost) no security at all, since most keylogging is software-based, and an attacker is willing to adapt his software to this virtual keyboard. Furthermore, you are certainly right that the right (security-conscious) mindset is also quite important. If you are a harder target, chances are high that attackers will go for the lower hanging fruit. –  Legolas Mar 20 '12 at 16:10
    
But these virtual keyboards are inside the page, so they don't send keystrokes to the browser like the OS's accessibility virtual keyboard would, so it would require a bit more of tampering, correct? (If I had to guess, their easy route would be capturing the screen's drawing events like a VNC would, instead). And indeed, being the hard target is almost like a security philosophy. –  Camilo Martin Mar 20 '12 at 17:28

It sounds like you work there based on your description but it was a little vague. If you bank with this bank, I would move my account and "find" Executives email accounts and complain on how insecure it is and that you will spread the word to other account holders and move them to a decent bank. The 4 digit pin on cards has been the "norm" for as long as I can remember. If you work there I would reccomend using something like the YubiKey which would add a layer of physical security and it's pretty cheap ($25 or so) chekc out http://www.yubico.com/yubikey --I am not affiliated in any way with any companies selling products, just a Geek with a Geeky job who enjoys playing with Geeky toys. er, I mean "testing at work" not playing with Geeky toys/hardware (management doesn't like the words "playing with") Again, if this info went public they would lose business. That should be an easy sell to impliment another layer of security.

share|improve this answer
1  
The only drawback to this approach is that a lot of these banks use a third party vendor to provide internet access. Mine does, so when I complained about a similar issue as the OP, I was listened to, but so far haven't heard anything back. Otherwise, yeah, complain to as many of the executives as you can, and spread the word so they'll dump the insecure vendor and get something decent. –  Tom Mar 20 '12 at 21:07
    
I do not work for them, just have an account. They're a government-owned bank, so you can expect they don't care as much about quality. So yeah, I could tell the bank and other users that their accounts are insecure, and I plan to do that, but I don't have much hope that I'll be listened. I'll look for alternatives in the future :( –  Camilo Martin Mar 21 '12 at 8:23
    
Did you look into the yubikey? why did my answer got voted down when I answered WITH solutions that are valid. Contact the execs and create a physical security aspect. If the execs do not respond create a campaign on social media sites to create awareness. Lastly I wouldn't do business with Gov't ran establishments if at all possible since they are generally incompitent, this is why they get compromised so easily as published in the newspapers and online of their easily avoidable mistakes like using the word password for the machines password. Not Secure, but only as intilligent as the user. –  Brad Mar 21 '12 at 16:34

What I am hearing is that you are unhappy with your bank. If you are unhappy with your bank's security protections, I'd suggest that you switch banks, or don't use your bank's online banking services.

Personally, I don't think think your bank's approach is so grossly unreasonable. Of course, it would be smarter if they put no upper limit on the length of the password, but in the grand scheme of things, this is kind of secondary. You have to keep a sense of perspective about this:

  • First of all, any password, no matter how long and strong, provides an imperfect basis for banking securely. Usually just the password is not enough to gain access to the online banking account; most banks will require something more, because they know that password have inherent limitations.

  • Second, a password between 8-10 characters, made up out of letters and digits, can be more than adequately secure, if chosen randomly. Assuming you choose every character to be a random letter or digit (62 possibilities for each character), a 10-character password that is chosen uniformly at random has almost 60 bits of entropy -- more than enough for these purposes. So if you are concerned, just choose your bank password randomly.

  • Third, many banks provide guarantees that if your online banking account is hacked and someone makes unauthorized transactions, the bank will reimburse you for your losses. If your bank has taken that position, then these issues are the bank's responsibility, not yours -- why worry about it? If your bank has not made those kinds of promises, then you have more of a conundrum whether to use their online banking services and accept the risk or not.

share|improve this answer
    
What you say does make sense, I guess a 10-character password has some good headroom for randomness. Plus your other points are valid too. +1 –  Camilo Martin Mar 21 '12 at 8:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.