I follow a few infosec-related Twitter personalities: Paul Moore, Taylor Swift, Troy Hunt are the main 3. Paul Moore is currently in the process of switching banks, frequently tweeting and retweeting about how insecure these banks are:
- crazy low password requirements (no symbols allowed, low max length are the biggest 2);
- buggy TLS implementations (article from Troy Hunt: http://www.troyhunt.com/2015/05/do-you-really-want-bank-grade-security.html), with many banks failing on stuff like Forward Secrecy, SHA-1, RC4 and TLS 1.2;
- weird password verification methods that usually prove that they're not hashing passwords (like asking for 2 specific characters from a password);
- weird ways to transfer account credentials (like asking a DM on Twitter, or support people giving your new credentials over the phone).
I realize that not all banks have these issues (for example, Belgian banks don't use passwords at all, instead requiring you to access E-banking through a card reader with your debit card, and most of them have appropriate TLS), but it does look like quite a few banks have at least 2 of these issues, and when called out on them, they act like it's not a problem. Meanwhile, we trust these companies with our money.
Why do so many banks have one or more of the above issues? I realize some of it is due to legacy requirements, but it can't all be because of outdated interfaces?