Slashdot Mirror
Why Gmail Has Better Security Than Your Bank
Gizmodo gives some insight to a strange situation that many of us have -- at least in the U.S. -- when it comes to online security: Gmail, while free, offers two-factor authentication, while many banks don't use security tools that would make online financial transactions safer, contenting themselves with single-factor, weak password systems, or lackluster secondary screens. It's certainly true at one bank I use, which even now allows short, all-alphabetical, all lower-case passwords. U.S. banks could certainly use multi-factor authentication, and some do, but it's nothing like universal.
Simple solution: name names and vote with your feet.
"I don't know, therefore Aliens" Wafflebox1
max password of 6 alphanumeric password, no special characters allowed. Fucking lunacy, and I remind them of it at least a couple of times per year.
Google is an IT company at the cutting edge of technology. Banks have an aging IT team working mainly on administrative tasks.
Slashdot, fix the reply notifications... You won't get away with it...
Doesn't access to my Gmail account allow people to "recover" my password to just about everything?
We should learn what we need to know about issues, before we decide what we need to feel about them.
Because banks have insurance against these losses, while Google doesn't. Next question.
http://economictimes.indiatime...
The same goes for every e-mail provider. Email account access is the crown jewel of online identity, because if I have access to your e-mail I can reset the passwords of all of your other online accounts, including your bank account.
If you're using a short, weak password and not using two-factor on your e-mail because "it's only e-mail"... please think about what other accounts use that e-mail address as their password reset mechanism.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Charles Schwab has a *maximum* of 8 character passwords and have had the same for 15-20 years!
Passwords: We maintain strict rules to help prevent others from guessing your password, and recommend that you change your password periodically. Your password must meet the following criteria:
6-8 characters long
Include both letters and numbers
Include at least one number between the first and last character
http://www.schwab.com/public/s...
I'd suggest it might be because of the support costs of all those people having trouble logging in, forgetting their passwords etc, or getting compromised because they wrote down their hard-to-remember password, if they went more secure. My bank allows a weak password (plus some nominated characters from a secondary "memorable phrase"), and no requirement to change it ever. TBH I'm pretty cool with that because I can remember both, so if I'm ever caught without access to my password manager, I won't be screwed. In order to add a new payment recipient, they do require a code sent to my registered phone to be entered. I feel it's a reasonable balance between security and convenience.
Oh no... it's the future.
Someone who knew grammar, evidently.
While Timothy's first sentence is, by some standards, long, and, moreover, interspersed with many appositives and subordinate clauses, which collectively may, depending on the reader's tastes and background, render it unwieldy, and even disgusting to those who like their thoughts in twitter-length bites, it nevertheless has this virtue: when analyzed by diagram, it does in fact appear to be properly constructed, at least within the limits of grammatical freedom that even the most rigid critics of English have come to respect, those limits having been established in indulgence of the liberties taken by the finest authors ever to have set pen to paper, among whom we may number, as an example particularly apt to such a case, Samuel Johnson.
I can't sue google if my information is stolen. My google products are not insured by my government. My bank account, however, has a huge paper-trail, and is insured, and I can sue my bank.
It's not about access security; it's about content security. My bank has more content security. It doesn't need access security -- that's just to reduce the number of times we need to go through the content recovery procedures.
Why Gmail Has Better Security Than Your Bank
Alright, just stop with the "your" headlines. They just sound so condescending, as if the author knows everything about everyone.
Which they don't, clearly, since my bank, like those of many other posters above, has two-factor auth. They sent me - free, without having to be asked, and presumably all their internet-enabled account holders have one - a little gizmo into which I put a number and it gives me back another number to be entered on the website.
That said, I'd rather have a username instead of "IB[10 digits]", and I'd rather just be asked for a password instead of "the name of the street you grew up on." The latter, certainly, would seem at first glance to less secure than asking for a generic password.
systemd is Roko's Basilisk.
From a British perspective, this all seems.... odd. Barclays and First Direct both use one-time time-limited two-factor authentication with the codes sent to special devices, and have done for quite a while, and the other components of their security are thoughtfully designed as well. They feel pretty secure to me -- not foolproof, but definitely good enough.
Picking a secure password is the user's responsibility, not the web site's. I use Diceware to generate my passwords. A five-word Diceware password has 77 bits of entropy. That's equivalent to a 15-character password chosen randomly from upper and lower-case letters, numbers, and 13 special symbols. Most can memorize the Diceware password in a few minutes. Few of us can ever remember the random password. Yet many web sites refuse to allow spaces between diceware words, and demand that I use an upper case letter and a number or special symbol. I curse every time.
Google needs be thousands of times more secure than my bank. My bank will return my money when their security lapses. The Feds even get into the act. If Google loses my information, it's gone. There is no undo. So while it may seem like a big problem for banks to be less secure, it makes perfect sense to me. Besides, I've lost countless web accounts (Yahoo, etc.) due to breaches not my own. I've never lost a penny from a bank, even when they are robbed and lose the actual bills I gave them. Money is fungible. Information isn't. So it's not even a valid comparison to make. Apples, and honeydew.