1

This question occurred to me when using online banking. My wife and I have a joint account. The username to login to internet banking is just our account number, so it is the same for both of us. Nevertheless the bank supplied us with 2 distinct passwords.

If the passwords where only given out by the bank and we would log into the same account this would probably be fine.

But first the bank actually forces us to each choose our own new password. In theory I could choose the same password as my wife and then the system would tell me 'you can't use this password because it is already taken' or something like that so I would have guessed my wifes password. Seems securitywise very shady.

Secondly although we access the same money in the bank account we don't have the exact same user account in the bank as for some actions the identity of the user is needed (for example 'please send a new credit card', should it be for me or for my wife?). The situation of one username combined with one password accesses one user account, the same username with another password accesses a different user account looks to me like a severe breach of security.

Is this actually fine or is the bank using some very sloppy and potentially unsafe programming for their joint accounts?

Edit: To specify what I'm mostly interested in. I'm not too worried that some third party hacker could break into our account because of this. I'm interested in the general principle. If I apply the same principle with all users instead of just 2 I would get a system where no username is needed and I identify users simply by the password they enter. This surely would count as not proper security. My question is whether this general problem counts as 'something to avoid in all situations' or more as 'it's fine as long the number of passwords is small' for some value of small.

Improve this question
2
  • 1
    It looks like you have two user accounts, you just identify the user accounts by bank account number combined with “the password that works”. I’d bet that if one of you opened a single-holder account (such as a 401k), that account would only be visible to one of the logins. I don’t see any sloppiness, other than the lack of mention of 2-factor authentication. IMO all financial accounts need 2-factor authentication.
    – Darrell Root
    Jan 16, 2020 at 8:55
  • @DarrellRoot The do have 2-factor authentification. My worry was more about the 'combine with the password that works' part, that seems very fishy to me.
    – quarague
    Jan 17, 2020 at 10:21

1 Answer 1

Reset to default
3

Your account is as secure as the weakest password able to access it. If one password is K_ig6W952B[1DGF3&8q.V^-}0ZN?rbDZ and the other password is Despacito2, then the effective security is almost nothing.

Assuming that both passwords are equal, there are still twice as many passwords as usual, meaning that a hacker attempting to crack hashes for your password will only work for half as long.

In practice, this will make no difference. You will lose 1 bit of security, which can be offset by just increasing the length of the password in your password manager.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .