4

The guys who made the security for my country's state bank are completely nuts in all senses. Their internet banking password must be between 8 and 10 characters, and contain only letters and digits.
I don't think I need to stress how insanely backwards such restrictions are.

In another news, my card's password must be exactly 4 numbers. I'm pretty sure most passwords are an year, and quite possibly an year between the first half of the past century and the current.

Meanwhile, my e-mail password has... 35 characters.

The only non-public thing needed to set up the online banking account is to have that 4-number password. It's also used in their ATMs along with a 3-syllable case-insensitive password that the bank gives you. I guess they realised their passwords were weak, so they thought, "hey, let's top that up with another insecure password".

Speaking of ATMs, they run some Windows version that I believe to be between 9x and 2k, whose desktop I saw in a ATM whose software seemed to have suffered a buffer overflow (there was a command prompt window open). This doesn't reassure me that they take security seriously.

So the question is:

When asked for a weak password, in the sense that the character set and count is limited, what do you do?

I considered hashing my current password, but it would be a nuisance to generate the hash all the time. My current solution involves applying a rememberable algorithm to the aforementioned 35-character password that I use in my e-mail.

Edit: even though an answer has been accepted, you're welcome to share your thoughts.

Improve this question
19
  • Oh, and they think that using mangled titles ("iNterNeT...bAN.King") in their website helps protect against keyloggers. They're not the only bank that does this.
    – Camilo Martin
    Mar 20, 2012 at 5:16
  • The username I choose also needs to be between 10 and 20 characters (yes the username may/must be twice longer than the password) and contain numbers. It's the first time I see such restriction on an username.
    – Camilo Martin
    Mar 20, 2012 at 5:19
  • 1
    The limitation on PIN-codes for the card itself is not so worse. Oftewn cards get blocked after 3 or so attempts, one needs to have the card, and it requires interaction with a terminal, which makes it more auditable. The web application is, however weak -- actually password authentication for such a thing is weak, of the banks I know (Dutch) all use some sort of external (trusted) device for authentication purposes. The best solution is making the most of it -- choosing the best password possible -- and often look at your statements for strange things, I'd guess.
    – Legolas
    Mar 20, 2012 at 6:56
  • 1
    I've tried summing up the discussion in an answer. Feel free to comment, as I am not completely sure if this is the answer you are looking for.
    – Legolas
    Mar 20, 2012 at 11:19
  • 1
    "between 8 and 10 characters, and contain only letters and digits." That's pretty secure if you choose them randomly. 51bits if you assume 26 letters, 59bits if you assume 52 letters.
    – CodesInChaos
    Mar 20, 2012 at 17:35

4 Answers 4

Reset to default
6

As discussed in the comments section, password based security is very minimal for banking, as it is worth the effort for a thief to try to steal your password. They basically only have to infiltrate your browser and log your entries. Furthermore, if this is achieved, they have full access.

Approaches such as hashing or other algorithms do not really matter, as you still will be typing in a password that has to commit to the set limits. Thus, you are really only making it harder to remember for yourself, but someone trying to bruteforce -- although it still is a lot of characters for bruteforcing -- still has to do the same effort.

We also discussed other approaches, such as security tokens -- which I personally prefer -- and SMS-based one time passwords. The idea of the former being that you must have your card at hand, and use this to set a signature. However, most non-connected implementations work by signing a number (hash) that most users cannot relate to the action that is about to take place, so a smart attacker may try to fool you by changing the numbers on the screen and the actual numbers. This is where the connected token comes in, which uses its display to show you the complete action you are about to allow, which is probably the most usable secure method out there at the moment. However, I have no idea on banks supporting these techniques in your region.

Finally, with banking security, auditing is most important. Check your statements for crazy transactions and report those as soon as possible. This still is the best approach to banking security. Recall, for example, that credit card fraud is not so hard, but recalling transaction is not hard either.

Improve this answer
4
  • 1
    Even though I think the average security-conscious person (such as probably everyone here) is a very hard target already, I concur banks should provide and recommend better security options. Regarding key-logging, it's probably not as easy, since most banks use virtual keyboards (but still possible). You rightly point out that the obligation of having your card at hand is the most secure of all approaches, but I really think the bank should allow users to opt-out of this, since they may find this cumbersome (so I think it's up to the user to sacrifice security for convenience). +1/accepted.
    – Camilo Martin
    Mar 20, 2012 at 15:17
  • I'll comment about what I plan to do, since beyond what has been said it's pretty much speculation (if a site forces weak schemes on us, we're screwed anyway). If I'm at home, since I trust my home computer, I'll just use it as normal. My password is at least a hard one to crack, even at 10 alpha-numeric characters. In a computer which is not mine, but that is trustable enough as not to have a hardware rootkit, I'd use a Linux live CD. Beyond this, I'll turn on SMS reporting of transactions (so I don't have to be checking for them periodically). Most banks support this I think (this one does).
    – Camilo Martin
    Mar 20, 2012 at 15:23
  • 1
    @CamiloMartin I fear that virtual keyboard add (almost) no security at all, since most keylogging is software-based, and an attacker is willing to adapt his software to this virtual keyboard. Furthermore, you are certainly right that the right (security-conscious) mindset is also quite important. If you are a harder target, chances are high that attackers will go for the lower hanging fruit.
    – Legolas
    Mar 20, 2012 at 16:10
  • But these virtual keyboards are inside the page, so they don't send keystrokes to the browser like the OS's accessibility virtual keyboard would, so it would require a bit more of tampering, correct? (If I had to guess, their easy route would be capturing the screen's drawing events like a VNC would, instead). And indeed, being the hard target is almost like a security philosophy.
    – Camilo Martin
    Mar 20, 2012 at 17:28
3

What I am hearing is that you are unhappy with your bank. If you are unhappy with your bank's security protections, I'd suggest that you switch banks, or don't use your bank's online banking services.

Personally, I don't think think your bank's approach is so grossly unreasonable. Of course, it would be smarter if they put no upper limit on the length of the password, but in the grand scheme of things, this is kind of secondary. You have to keep a sense of perspective about this:

  • First of all, any password, no matter how long and strong, provides an imperfect basis for banking securely. Usually just the password is not enough to gain access to the online banking account; most banks will require something more, because they know that password have inherent limitations.

  • Second, a password between 8-10 characters, made up out of letters and digits, can be more than adequately secure, if chosen randomly. Assuming you choose every character to be a random letter or digit (62 possibilities for each character), a 10-character password that is chosen uniformly at random has almost 60 bits of entropy -- more than enough for these purposes. So if you are concerned, just choose your bank password randomly.

  • Third, many banks provide guarantees that if your online banking account is hacked and someone makes unauthorized transactions, the bank will reimburse you for your losses. If your bank has taken that position, then these issues are the bank's responsibility, not yours -- why worry about it? If your bank has not made those kinds of promises, then you have more of a conundrum whether to use their online banking services and accept the risk or not.

Improve this answer
1
  • What you say does make sense, I guess a 10-character password has some good headroom for randomness. Plus your other points are valid too. +1
    – Camilo Martin
    Mar 21, 2012 at 8:55
0

Ok, here is my opinion. Using Keepass(or any password manager) you could generate a random password like this "CslmHD5Rh6" This is a fairly secure password. According to grc haystack the chances of breaking this password would be 1 in 853,058,371,866,181,866. The only way to break this would be with the hash of the password which if they were able to get the hashes that would be a larger problem for the security of the bank. Though, with the hash it would take 3.25 months at 100 billion guesses a second. Which is actually a lot. In 2013 Edward Snowden cautioned about the ability for the NSA to crack passwords at 1 trillion guesses a second. Here in 2016 a hacker might have those speeds, but it would be outrageous for them to devote that much time to a strong password like that.

Improve this answer
4
  • With an account name like @keepass_fan in this context people might think (I don't) you could be spamming. Yeah, auto-password-generators are great. I use that for all passwords except e-mail (and old passwords, and the LastPass password). Also, since LastPass was aquired by some shady outfit (LogMeIn), I'm considering switching to something else. Is Keepass comfortable on Android?
    – Camilo Martin
    Jan 26, 2016 at 5:52
  • Yeah. I couldn't come up with a name. It is kind of old. Keepass with Android does the job no complaints, but I haven't tried any competitor yet(on Android). You need to find an app you like for it as sadly no official app exists. I use Keepass2Android Offline. It does the job. For cloud syncing they make another version for sync to file storage. I have heard good things about Dashlane though(I have used Keepass, Dashlane, and Lastpass). Keepass is probably best if you don't trust anyone.
    – keepass_fan
    Jan 28, 2016 at 5:13
  • Thanks, just one more question - does Keepass on android have any alternative to the (not very secure) clipboard?
    – Camilo Martin
    Jan 28, 2016 at 7:12
  • No, sadly it seems to have no alternative. It does have auto-clearing and some features to protect it. Though if spyware is the concern(guessing here) I would say you should enable a firewall. There are root and non-root options. That could do the trick. The most secure way would be if there is an addon for mobile firefox that can store passwords. I don't think that has happened yet. Though I rely on a keepass/firewall combo for security personally.
    – keepass_fan
    Jan 28, 2016 at 22:04
-1

It sounds like you work there based on your description but it was a little vague. If you bank with this bank, I would move my account and "find" Executives email accounts and complain on how insecure it is and that you will spread the word to other account holders and move them to a decent bank. The 4 digit pin on cards has been the "norm" for as long as I can remember. If you work there I would reccomend using something like the YubiKey which would add a layer of physical security and it's pretty cheap ($25 or so) chekc out http://www.yubico.com/yubikey --I am not affiliated in any way with any companies selling products, just a Geek with a Geeky job who enjoys playing with Geeky toys. er, I mean "testing at work" not playing with Geeky toys/hardware (management doesn't like the words "playing with") Again, if this info went public they would lose business. That should be an easy sell to impliment another layer of security.

Improve this answer
3
  • 1
    The only drawback to this approach is that a lot of these banks use a third party vendor to provide internet access. Mine does, so when I complained about a similar issue as the OP, I was listened to, but so far haven't heard anything back. Otherwise, yeah, complain to as many of the executives as you can, and spread the word so they'll dump the insecure vendor and get something decent.
    – user6404
    Mar 20, 2012 at 21:07
  • I do not work for them, just have an account. They're a government-owned bank, so you can expect they don't care as much about quality. So yeah, I could tell the bank and other users that their accounts are insecure, and I plan to do that, but I don't have much hope that I'll be listened. I'll look for alternatives in the future :(
    – Camilo Martin
    Mar 21, 2012 at 8:23
  • Did you look into the yubikey? why did my answer got voted down when I answered WITH solutions that are valid. Contact the execs and create a physical security aspect. If the execs do not respond create a campaign on social media sites to create awareness. Lastly I wouldn't do business with Gov't ran establishments if at all possible since they are generally incompitent, this is why they get compromised so easily as published in the newspapers and online of their easily avoidable mistakes like using the word password for the machines password. Not Secure, but only as intilligent as the user.
    – Brad
    Mar 21, 2012 at 16:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .