I have recently opened an account at a brokerage firm, based in India, which unfortunately it seems to me is not following good measure to ensure security. But I maybe wrong since I am not an expert in this field. Hence I am asking for help.

The firm on their webpage login, restricts the password length to max 12 characters and asks me to answer 5 stupid questions such as "What is your mother's maiden name?" as a 2FA measure. For some reason in one of their FAQ webpage they also suggest that the user can answer the 5 questions with "a" since that will be easier to remember. As a added measure of security if I enter wrong password more than 3 times, my account will be locked and I'll have to reset my account using the 5 security questions. In their privacy policy they mention only one fact about account security, that they use SSL encryption. They never mention if they have had any security audit done by Verisign, Norton, or other third party.

Are they being lax in their online security? If so how much and what are the minimum measures an institution like them should take to ensure online safety of their customers account?

  • Many financials will not announce their penetration testing, despite The fact they will have had to have some completed if they store any card data. Typically they will use one or more of the top rated penetration testing companies. Not one of the 2 you mention...
    – Rory Alsop
    Aug 9, 2016 at 7:32
  • What I do in these cases is to use the password manager to create random passwords for the secret questions. And then simply store them in the notes field in the manager or something.
    – Potaito
    Aug 9, 2016 at 7:42
  • @potAito That's a good suggestion that i already follow, but even then it seems to me that using static keys for 2FA is not the correct way. A dynamic key generated by an app like Google Authenticator is what they should be using for 2FA.
    – user120932
    Aug 9, 2016 at 8:11
  • 1
    It's hard to imagine that they actually use secret questions for 2FA. You are completely right: It's static information and as such worthless once someone gets a hold of it. Then it comes down to the strength and secrecy of the actual password. So, is your account in danger? Apparently not if you have a strong 12 digit password and generate random answers to secret questions. Is it good practice? I doubt it. Seems to me like they want to impress customers with "advanced" security measures. Considering their FAQ they also seem to have internal disagreements on this...
    – Potaito
    Aug 9, 2016 at 8:18
  • 1
    Suggesting a maximum password length is bad practice. Making suggesting that counter security measures is bad practice. These are two major mistakes that a decent financial institution would not make. Don't trust them! They might have several security issues that can compromise your privacy, data, money,..
    – Silver
    Jan 6, 2017 at 15:08

1 Answer 1


I work in the in the IT security profession as an IT Auditor. You are right to be concerned because from your description, the site is insecure. Specific points of weakness are described below:

Use of the no longer secure SSL protocol

Secure Sockets Layer (SSL) is no longer secure due to downgrade attacks such as POODLE Early versions of Transport Layer Security (TLS) share similar problems. If feasible, the site should be using TLS 1.2.

No mention of use of certificates for the website

Certificates are used to validate the identity of the website you are logging into. Without a valid certificate you cannot be sure you are signing into the true, legitimate website because the website could very well be a phishing site designed to mimic the real site. Key information that you would want to confirm to be comfortable your sensitive data is safe are:

  1. Method used to sign the certificates - key length and encryption method

  2. Who the certificate authority (CA) is that signed the certificate and whether this CA is trusted by your browser.

  3. Whether the certificate name matches the website name and expiration date of the certificate has not passed.

Other key factors while not mentioned, but which you would want validate are:

Password requirements other than length

The password requirements should ideally include complexity requirements such as mixing capital letters, lowercase letters, numbers, and special characters. The purpose is to mitigate against the brute force attack whereby automated tools are used to try all possible combinations until the right password is found.

Safeguards against web-based attacks

The website where you are sending your financial data should be designed to have safeguards in place against common web-based attacks such as XSS, injection attacks, and fixation attacks. In this respect, safeguards would be centered around proper validation of user input.

  • While there are SEVERAL grounds for concern, those you have enumerated here strike me as most peculiar from a security professional. You might consider reading the first sentence on the wikipedia page for tls. Anyone concerned about the use of ssl (or tls) can simply look at the url field, and for the specific protocol and specifics of the certificate in use need only click on the appropriate widget in the chrome of the browser when its pointing at the site to find these details.
    – symcbean
    Apr 6, 2017 at 22:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .