Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How common is it for a bank to request you to make a user ID as well as password when banking? Should they simply use a pre-determined number such as your credit-card, or are there advantages to have users make IDs?

share|improve this question
    
While this is horribly worded I can't think of a better way of saying it. –  Griffin Nowak Jun 20 '13 at 23:31
    
there are disadvantages to letting users make their own IDs, ranging from poor entropy, to using ID creation to gather information about other IDs etc. –  Rory Alsop Jul 10 '13 at 21:56

6 Answers 6

All the banks I use require me to make a user ID. I believe having an issued ID would be better security, but from a business standpoint you are just making things extremely unpleasant for your users.

I don't think it would be realistic to assign a credit card number as an ID because users could have multiple credit cards or accounts under the same bank, and again the bank wouldn't want to make things difficult for the users. Let's not forget too that everyone would be forced to have very long user names!

Also, you would think that your credit card number is something you want to keep secret as well, but having it as an ID may very well hurt security. Imagine the scenario where someone is lazy and types very slowly(maybe doesn't have a numpad as well). So, this person decides to leave his/her credit card number somewhere and copy paste that when going on the banking site. Well, now it's entirely possible that this person will accidentally post it somewhere else if he/she doesn't remember to copy something else to the clipboard.

All in all it just seems like a lose lose situation

share|improve this answer

When it comes to online banking there aren't many advantages or disadvantages to having users make IDs. The only things I have come up with are as follows-

Advantages -

Easy to remember log in info. This means if I don't have my credit card with me and I haven't memorized its number then I can still log into my account.

Added layer of protection. What I mean by this is that if someone gets my credit card they don't already know my username. The gaming community has started taking on this "dual user name" system. What that means is that your name in game isn't your user name to log in. This prevents people from already having one of the two answers.

Hashing (Correct me if I'm wrong here I very well might be). When you hash a password you also want to "salt" it with something. This makes it harder to do anything with the hashes if they are obtained.

Management. Say you have a kid and his name is Joe. Well you get Joe his own credit card which is attached to yours, instead of needing to know his password in order to keep up with him you can find out he's buying beer & cigarettes without needing to ask him for the password. You can also control things like how much he can spend this month so on and so on. This also applies to companies.

Disadvantages -

People may forget their user name. (Though you can still authenticate them via other means)

Usernames are not as long. Giving users the option to make their own names can cause problems due to the fact that they don't choose a name that is as long and random as a credit card number. (However attackers know credit card numbers are all numbers where as usernames can include letters and numbers so this is up in the air)

That's all I can think of for now. If anyone has their own feel free to add to it. (I dislike the formatting of this personally but I can't seem to make it right)

share|improve this answer

All banks I know and do online banking with (about 5 here in Switzerland) issue a user ID. And you can't chose the ID; it's just a number you get when you request to do online banking. Of course you additionally need a password and a one-time password to login. The password you can choose yourself and the one-time password is something you get from your bank. In the old days they sent out a sheet of paper with 100 numbers (numerated) and each login they asked you for number X on the sheet. After usage you would cross it out. and when 80% of the sheet was used, they sent you a new sheet. Nowadays all banks use hardware tokens (RSA SecureID, YubiKey, etc.). The safer banks also use transaction verifications.

I would not link the user id to any existing number, like the credit card number, because maybe offer one additional service for the client and then the client doesn't use the credit card anymore. So a separate user id is better. Also I don't see any reason why you would let the user choose a name or number as his/her id, that only results in conflicts with users that register earlier.

Also having an ID different from the credit card number is kinda safer, because then the client can lose/disclose the ID and nobody can do anything with that information alone; nobody can associate it with the client or with the credit card or whatever.

Of course, you always have to handle the cases where users forget their ID, similar to forgetting their password or one-time password lists or losing their authenticator devices.

share|improve this answer

If users can choose their user IDs, the registration process for new users will leak whether a user ID is already in use at the bank. When a new user chooses an existing user ID, the bank will have to disclose that the ID is already taken and ask the user to select another one.

It's considered bad practice to leak existing user IDs in a system, that's why secure authentication procedures take care not to leak this information. The most obvious example being the generic error message you get when entering a wrong username/password: "Invalid username or password", instead of the more user-friendly approach "invalid username" when the username was wrong and "invalid password" when the username existed but the password was wrong. You often come across sites that take the correct approach to authentication, but still leak the user IDs in their registration process.

The scale of the leak will vary with the registration procedure. If the registration procedure is online, you might be able to automate the testing of user IDs to see which are in use or not. This depends on how they've actually implemented it, the bank could e.g. use CAPTCHAs to limit the success of such attacks.

So, I'd recommend an ID issued by the bank, or the re-use of an existing unique ID such as a National Identity Number (NIN, it varies around the world how unique/suitable those are).

Here in Norway we have unique NINs and the banks are required to have them anyway, so they are quite suitable as user IDs.

I see credit card numbers as user IDs are mentioned. It's been a while I since did any work around PCI, but AFAIK that would raise a bunch of PCI issues for the authentication procedure so I wouldn't recommend that.

share|improve this answer

I think its a relatively arbitrary decision by the bank that depends more so on the products they sell than anything else.

The more products they offer, its more likely that you'll have the option for a generic login ID because customers simply may not have a card. Most will let you log in with the card number though.

share|improve this answer
    
What do you mean by products? Now you have me confused. What are they selling you and why wouldn't customers have a card / number? –  Griffin Nowak Jun 20 '13 at 23:52
    
Any and all accounts and services they have are products. I'm talking things like mortgages, investments, long-term savings, etc. –  Steve Jun 21 '13 at 3:44

It is better to allow the user's to have their own userID , having the user id as a number be it a card number or a serial number of 5-10 digits makes it susceptible to account blocking attacks .

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.