0

I have recently opened an account at a brokerage firm, based in India, which unfortunately it seems to me is not following good measure to ensure security. But I maybe wrong since I am not an expert in this field. Hence I am asking for help.

The firm on their webpage login, restricts the password length to max 12 characters and asks me to answer 5 stupid questions such as "What is your mother's maiden name?" as a 2FA measure. For some reason in one of their FAQ webpage they also suggest that the user can answer the 5 questions with "a" since that will be easier to remember. As a added measure of security if I enter wrong password more than 3 times, my account will be locked and I'll have to reset my account using the 5 security questions. In their privacy policy they mention only one fact about account security, that they use SSL encryption. They never mention if they have had any security audit done by Verisign, Norton, or other third party.

Are they being lax in their online security? If so how much and what are the minimum measures an institution like them should take to ensure online safety of their customers account?

  • Many financials will not announce their penetration testing, despite The fact they will have had to have some completed if they store any card data. Typically they will use one or more of the top rated penetration testing companies. Not one of the 2 you mention... – Rory Alsop Aug 9 '16 at 7:32
  • What I do in these cases is to use the password manager to create random passwords for the secret questions. And then simply store them in the notes field in the manager or something. – Potaito Aug 9 '16 at 7:42
  • @potAito That's a good suggestion that i already follow, but even then it seems to me that using static keys for 2FA is not the correct way. A dynamic key generated by an app like Google Authenticator is what they should be using for 2FA. – user120932 Aug 9 '16 at 8:11
  • 1
    It's hard to imagine that they actually use secret questions for 2FA. You are completely right: It's static information and as such worthless once someone gets a hold of it. Then it comes down to the strength and secrecy of the actual password. So, is your account in danger? Apparently not if you have a strong 12 digit password and generate random answers to secret questions. Is it good practice? I doubt it. Seems to me like they want to impress customers with "advanced" security measures. Considering their FAQ they also seem to have internal disagreements on this... – Potaito Aug 9 '16 at 8:18
  • 1
    Suggesting a maximum password length is bad practice. Making suggesting that counter security measures is bad practice. These are two major mistakes that a decent financial institution would not make. Don't trust them! They might have several security issues that can compromise your privacy, data, money,.. – Silver Jan 6 '17 at 15:08
-1

A 12-characters password is long enough not to be easily crackable.

Are you sure those questions are for 2FA? It doesn't make sense. Those questions are likely for helping in the recovering process, but definitively not a 2FA. That recommendation in their FAQ is pretty WTF??, guess lot of people is using that answer to their questions xD

The three attempts or lock is very strict IMO, but well, there you have added security.

In summary, if it's a legal financial firm it should have passed the PCI-DSS, so you can be sure that it has a good security standard.

  • They use security questions for both 2FA and account recovery, though i believe and hope that for account recovery they'll talk to me over phone. The firm is legal but based in India, so I am not sure if they they are legally bind to follow PCI-DSS. I also don't know what guidelines are legal financial institutions supposed to follow according to Indian Law and if these guidelines are actually good enough in today's world. – user120932 Aug 9 '16 at 8:08
  • @user120932 then, provided the facts you stated in your question + comment, I'd definitively not trust this company. It looks like they have no clue about how to implement security. This boils down to a trade between risk-cost. If you choose such a firm is likely because their price is lower than the competitors, but, have you measured the risk? Is the price low enough to assume risk? Unfortunately, we can't help you with such decision, as it's up to you. – eez0 Aug 9 '16 at 9:06
  • Luckily for me I haven't started using their services as yet. I wrote this question as soon as I first signed in on their website, to confirm my suspicion that they are cutting corners with security of their services. I think my suspicion are true. I have written an email and posted a quora question to their executive asking an explanation to my concerns, which i am doubtful they'll be able provide. Thanks for the help. – user120932 Aug 9 '16 at 10:15
  • 3
    PCI is only about card data security, it has nothing to do with the rest of the financial sector. – SilverlightFox Aug 10 '16 at 9:17
  • It's a common norm in India to allow max 3 invalid attempts to login to financial firms' online accounts – Limit Oct 8 '16 at 13:34
-1

I work in the in the IT security profession as an IT Auditor. You are right to be concerned because from your description, the site is insecure. Specific points of weakness are described below:

Use of the no longer secure SSL protocol

Secure Sockets Layer (SSL) is no longer secure due to downgrade attacks such as POODLE Early versions of Transport Layer Security (TLS) share similar problems. If feasible, the site should be using TLS 1.2.

No mention of use of certificates for the website

Certificates are used to validate the identity of the website you are logging into. Without a valid certificate you cannot be sure you are signing into the true, legitimate website because the website could very well be a phishing site designed to mimic the real site. Key information that you would want to confirm to be comfortable your sensitive data is safe are:

  1. Method used to sign the certificates - key length and encryption method

  2. Who the certificate authority (CA) is that signed the certificate and whether this CA is trusted by your browser.

  3. Whether the certificate name matches the website name and expiration date of the certificate has not passed.

Other key factors while not mentioned, but which you would want validate are:

Password requirements other than length

The password requirements should ideally include complexity requirements such as mixing capital letters, lowercase letters, numbers, and special characters. The purpose is to mitigate against the brute force attack whereby automated tools are used to try all possible combinations until the right password is found.

Safeguards against web-based attacks

The website where you are sending your financial data should be designed to have safeguards in place against common web-based attacks such as XSS, injection attacks, and fixation attacks. In this respect, safeguards would be centered around proper validation of user input.

  • While there are SEVERAL grounds for concern, those you have enumerated here strike me as most peculiar from a security professional. You might consider reading the first sentence on the wikipedia page for tls. Anyone concerned about the use of ssl (or tls) can simply look at the url field, and for the specific protocol and specifics of the certificate in use need only click on the appropriate widget in the chrome of the browser when its pointing at the site to find these details. – symcbean Apr 6 '17 at 22:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.