5

My bank has an online password security policy which seems to me 100% wrong at all levels. Since it is one of the biggest banks in my country, I'm giving it the benefit of the doubt, and consider the possibility that I'm not seeing the full picture...

The way I access the online portal is using my ID card number (issued by my country) as username, and the same PIN from my main credit card as password. This seems wrong for several reasons:

  • The password I use for accesing online banking features is a 4-digit PIN.
  • I cannot easily change my online banking password, I have to go to an ATM and change my PIN.
  • If I happen to lose my credit card, which is bad enough, also my online banknig features would be compromised.
  • Even though some of the most "risky" features require an aditional so-called "digital-firm" which is chosen by me, this digital-firm must be an 8-digit PIN.

Is this bad enough as it seems (like get out of that bank bad enough)? Could they be using any security policies which I cannot see to mitigate possible attacks? Are these kind of bad policies common whithin big banking firms?

Improve this question
4
  • 3
    That's pretty terrible but nothing new from banks. I've had accounts at quite a few of them in various countries, and they seem worse than everyone else when it comes to account security online. The one thing they could do to make a 4-digit pin not "absolutely horrible" would be to lock the account after 3 or so bad attempts (globally, not per IP or anything).
    – Marc
    Dec 13, 2017 at 17:39
  • 1
    @Marc I'm not sure that really helps, given the attackers aren't necessarily trying to compromise a specific account, but rather any account. In other words, assuming I know usernames - if I just guess three random numbers for every user, I'll get into 1/3000 users accounts. If I start guessing highly used PINs, the odds can only go up. I can't think of any great way to secure this system, honestly.
    – Cowthulhu
    Dec 13, 2017 at 17:48
  • I agree. Note that I only said that would help make it "not absolutely horrible". Still "really horrible" though. Absolutely horrible would mean not having this kind of hard limit for bad guesses in which case it's insanely cheap to guess pins.
    – Marc
    Dec 13, 2017 at 17:53
  • Yes, I really hope they make this kind of locking, otherwise it would be insanely easy to crack any account!
    – Daniel García Rubio
    Dec 15, 2017 at 12:24

1 Answer 1

Reset to default
5

This is wrong on so many levels I don't even know where to start...

  • Four digits? Seriously? Even if you implement all the brute force detection in the world, someone could easily break into an account on the first try just by being lucky!
  • You can't hash four digit numbers in a meaningful way. No matter how high cost factors you set for bcrypt, it's not going to help much. That means that all the PINs must be stored in a reversible manner. If that database leaks, there is nothing protecting your account...
  • Having people enter the PIN to their credit card on a computer is a horrible idea to begin with, no matter what you use it for. Your PIN should be entered to credit card readers, nothing else. Teaching customers to give it away on websites isn't a good idea.
  • As you say, a credit card PIN is harder to change than a password.
  • An 8 digit PIN is better than a 4 digit one, but still not nearly good enough. Why not allow people to use real passwords? Or 2FA?

No, there are no excuses for this. There are no clever protections that can make this fine. Consider changing to another bank.

Improve this answer
2
  • Thanks for your comments, you kind of confirmed what I thought. I guess the first step would be changing the PIN of my credit card to an 8-digit one (i think it can be done, almost no body does this though). This way any random attack would be a little harder, and also I would avoid the 4-digit attack, which is the 99% case and what they are probably going to try first.
    – Daniel García Rubio
    Dec 15, 2017 at 12:22
  • I understand this is probably not enough though, and I sould consider changing to another bank if they don't improve their policies in the future.
    – Daniel García Rubio
    Dec 15, 2017 at 12:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .