3

Few months ago, my bank forced me to change my password. It was a random 32 characters long password, stored in a well-known password manager.

The new password had to be exactly 8 digits, to be entered manually by clicking on a randomly organized virtual keyboard (of 10 buttons, from 0 to 9), with some JS code preventing any copy-paste or the use of my password manager.

My questions:

  • How does that new password policy changes the overall security of my bank account ?
  • Should I be worried that now my bank account is only protected by an 8-digit password, whereas standard security rules I know for years do advice for using a wide range of characters, and (way) more of them (typically, 12 characters mixing digits, lower, upper case and special characters) ?
  • Since my bank is not the only one to switch to that security policy (I know at least 2 other banks doing so, one being out of my country), I start to think a security group listened by banks is the origin of that policy change. Where do I start to look to learn more about this sudden and seemingly global change of policy ?
Improve this question
2
  • 2
    The randomized keyboard is attempting to protect against certain classes of clipboard harvesting and screen readers, but they'd have been better off to enable 2FA via TOTP. This setup is actually common with lots of MMOs (usually Asia-region ones)....
    – Clockwork-Muse
    Jun 2, 2020 at 18:14
  • 1
    Sounds like time to get a new bank.
    – multithr3at3d
    Jun 2, 2020 at 23:00

1 Answer 1

Reset to default
1

How does that new password policy changes the overall security of my bank account ?

It's gotten worse. The concept of using a virtual keyboard is relatively old, can be bypassed, is still vulnerable to replay attacks and there's enough malware that scrapes mouse movements and matches it to partial screenshots to enable decoding of this. provided your password is static

What would have been a significant step up in security would be the implementation of two factor authentication. Even with the decrease in password strength and virtual keyboard gimmick.

Should I be worried that now my bank account is only protected by an 8-digit password, whereas standard security rules I know for years do advice for using a wide range of characters, and (way) more of them (typically, 12 characters mixing digits, lower, upper case and special characters) ?

Well, yes, from a technical point of view that is a significant step backwards in security.

Since my bank is not the only one to switch to that security policy (I know at least 2 other banks doing so, one being out of my country), I start to think a security group listened by banks is the origin of that policy change. Where do I start to look to learn more about this sudden and seemingly global change of policy ?

No clue, and it's even more worrying if in fact they changed because others did.

Improve this answer
1
  • 1
    The password is always the same (unless, obviously, i change it manually by myself). Two factor authentication never has been proposed. As said by @multithr3at3d, it's time to change my bank. Unfortunately the bank i wanted to join just adopted that new password policy…
    – aluriak
    Jun 2, 2020 at 23:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .