5

With Bug #1025703 in the latest Firefox 38, Mozilla has finally decided to stand up for its users instead of catering to the banks that don't want the passwords remembered.

However, I've noticed about a year ago or so, that the remember-password bookmarklet has long as stopped working on oh-so-many sites, especially the bank ones, due to some extra javascript tricks, so, it's not really clear what the above change is for, perhaps just to remove and cleanup a feature that has long as been redundant and broken.

But the persistence of firms trying not to have the passwords remembered undoubtedly contributes to the easiness with which fishing attacks can performed -- if their users are accustomed to entering their passwords when returning to a tab after 15 minutes of inactivity in a given tab, on a whim's notice, fishing is just so much easier when they're all ready and willing. Compare it with the Password Manager approach, which securely stores the passwords within, and is pretty much guaranteed by design to only reveal them to the correct web-sites.

So, why do the banks continue to do this, the mouse and cat game of preventing the passwords from being saved in the Password Manager? Aren't password managers a good way to ensure no fishing can be performed on one's customers, since they don't even know their own passwords?

  • 2
    Note that storing the passwords in a password database may not be secure, unless the DB itself is well protected (with e.g. a master password, which about nobody sets). I'm happy to live in NL where password-based authentication is considered insufficient for access to bank accounts - let alone for protecting transactions. – Maarten Bodewes May 21 '15 at 12:10
5

While there are aspects of truth in what you say, you have to look at the bigger picture and look at where banks have liabilities and risks. Banks look to minimise the risk down to a certain level (eg there is a fraud appetite that is accepted by banks, as to try and reduce it further costs more and more, rapidly becoming unworkable) and many of these drivers conflict with user experience requirements.

Additionally, technical requirements form a good part of the risk profile and appetite for a bank. So that also leads to trade-offs.

Allowing user devices to store credentials could be a way for attackers to gain even easier access than their current phishing success rate, so unless you have a strictly enforced set of standards by which all password managers work, that can also be audited and assessed by the banks, you are in a position where you may be improving security but you may be decreasing it.

The worst case for the banks there is that security becomes reduced, customer accounts are attacked, and the banks are held liable for it.

So keeping the onus on the customer to control their credentials is generally considered better for the majority of customers, and the bank as a whole, while for some customers it will be worse. And for those customers, they can improve their security through awareness training.

  • 1
    Well, based alone on what you say, I'd argue that if a user's computer is compromised, it's clearly the fault of the user. On the other hand, if the user receives an email, asking them to provide a password for the bank, -- that sounds more like the bank's fault for failing to create a policy against such emails, and clearly inform the user of such policy. (And, ironically, it's quite amazing how many times I've received emails from various banks (including PayPal) that, failing a passing header inspection, I'd identify as a phishing attack!) – cnst May 22 '15 at 18:08
2

Banks have real money losses, a significant amount of this comes from unauthorized access to bank accounts so they have financial incentives to make it harder for users to lose their password by storing it in the browser at their local internet cafe/library/etc.

  • by making it harder to store it in the browser means that fishing will be easier; it's a pendulum, why do they swing it only one way? – cnst May 21 '15 at 18:20
  • 1
    Besides, the credentials used for e.g. credit card access, never have any way to transfer money or do anything "useful" with the account, other than looking at the transaction history. Even new card requests are often protected by the customer being required to provide the CCV number of their physical card. – cnst May 21 '15 at 18:22
2

Banks are normally very large, bureaucratic organizations driven by policies written by people that were well meaning, but can't respond very well to changing threats.

Are Phishing attacks worse than compromised machines where the password is stolen? I'm not sure, but it's a valid discussion. Saving the password locally is easy to understand, and for years people have been given the advice "don't write down your password on a piece of paper" (even though this is likely poor advice in a networked world with different threats). Phishing is much harder to understand, and it's likely that a bank might think the liability exists on the customer because they "did something" whereas a computer compromise would be harder to pin on the customer.

If banks really thought deeply about security, they'd offer 2-factor authentication like GMail does. It's a trivial exercise, but so far I've only seen one bank offer this. Since most banks don't offer this, I can only gather they don't have terribly sophisticated people who are willing to push for higher levels of security, and think about the threat models against them.

  • Actually, as per the comment in the other answer, I'd argue the complete opposite -- a computer compromise is clearly the user's fault, whereas phishing is not. "On the other hand, if the user receives an email, asking them to provide a password for the bank, -- that sounds more like the bank's fault for failing to create a policy against such emails, and clearly inform the user of such policy. (And, ironically, it's quite amazing how many times I've received emails from various banks (including PayPal) that, failing a passing header inspection, I'd identify as a phishing attack!)" – cnst May 22 '15 at 18:12
  • How can a computer compromise be the users fault? You're telling me a 0-day exploit in a browser is my fault, and not the browser makers fault? How is even a highly trained person supposed to avoid computer compromise, much less an average user? – Steve Sether May 22 '15 at 18:48
  • @SteveSether That's a false dichotomy, though a popular one. If the machine is already compromised - why would browser-encrypted password storage be more vulnerable than the form in which the user is filling out the password? Or for that matter, all traffic from the machine, regardless of whether the password was typed in or stored securely. I am not saying there is no tradeoff with browsers storing passwords, but that ain't it. – AviD Dec 8 '15 at 10:46
  • @avid I think you might be misunderstanding my comment. I agree with what you're saying. My point is really that "the computer is compromised" is the users fault is simply wrong. Fault implies there's something you could have done to prevent it. I myself, (and pretty much everyone on this forum) can't prevent their own computer from being compromised by a 0-day driveby browser exploit. How can we expect an average user to protect themself from compromise when highly trained people can't? – Steve Sether Dec 8 '15 at 14:49
  • @SteveSether yeah I agree with you on that. I was referring to this statement: "Are Phishing attacks worse than compromised machines where the password is stolen? " Interestingly, that is often the ---excuse--- reasoning I hear from banks for precisely this decision, i.e. blocking password storage (at the expense of increased phishing risk) because of the risk of machine compromise... which makes no sense, as I said in my previous comment ... :-) – AviD Dec 9 '15 at 8:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.