Hacker News Reader

Comment by dessant | Hacker News Reader

That's exciting news, though it will take a couple of years until it trickles down to financial institutions. My bank forces me to change passwords every 3 months, and of course they also disable pasting for added security.

We also have a local utility that sends you a 5 letter password upon account creation through email, and that's your password. If you try to change it, they'll send you another 5 letter one.

View on HN

> and of course they also disable pasting for added security.

With Firefox, you can set this about:config setting to false to give you back the ability to paste, even when sites try to block it:

dom.event.clipboardevents.enabled

Disabling clipboard events will break certain helpful paste mechanisms too, for example pasting images to upload.

There's an extension called Don't Fuck With Paste, which is a better solution.

Can you explain why this is better than changing the configuration?

Presumably because the config option disables all access to paste events and this access is sometimes desirable.

I had to disable that extension for Facebook and MS teams or weird state happens. I would paste text, undo it all and still have text left over.

Bank programmers live at least 5 years in the past.

I'd say this is because it takes that long to get a feature from design to production, in a bank.

Bank programmers don't live. They exist.

Military programmers live 20 years in the past because the contracting system forces them too. The contracting people live in 1970. The actual flag officers in charge live like it's 1955.

Depends on the bank. I guess in US banks themselves are 20 years in the past. My bank had this log-in setup, where you have your fixed password but also need to enter a password from your password card. This is being phased out and will not be available from Sep 1st. I myself have been using mobile signature/smart-id (https://www.smart-id.com) for years now. Other remaining options are using your ID card or passcode generators—like Google Authenticator but a physical device.

PCI certification requires passwords to be rotated every 90 days.

Now that NIST is on board with long lived passwords, I really hope the next iteration of PCI follows suit.

NIST has been recomending this for 3+ years now. The question is how long will it take for PCI to pick up on it?

German banks also like their 5 character passwords! Fortunately you also need a per-transaction TAN code which makes this a bit better (though many people have this on paper or via an SMS, though perhaps paper is not that bad).

If you're in need of business banking, you can use mercury.co (my company) and enjoy unlimited length, non-paste-breaking, password manager compatible, no expiration, no character restriction passwords + non-SMS based 2FA :)

Hopefully we have five years before competitors catch up to us and implement this cutting edge technology!

I have 2 and 3 year CDs in a bunch of banks. (This is a common use case, people open separate accounts because of the FDIC insurance limit in any one bank). I only need to log in again 2 or 3 years after opening the account to either take the money out, or open another CD.

Some of these banks expire passwords every 6 months! That's insane. I have calendar reminders set to remind me to log in and generate another password with LastPass.

I can't recommend e-banking enough. Through Fidelity you can purchase CDs from a number of banks across the country, shopping for the best interest rates. And you can create an auto-rolling CD ladder if that's your thing. I presume other e-banks like Schwab have similar features. Then you can manage all these things in one place, while getting the benefit of having your funds FDIC insured because they're technically CDs at multiple banks behind the scenes.

I would think money market mutual funds are a more liquid, easier, higher yielding version of that. They don’t have the FDIC insurance, but they’re well diversified and invest in the highest grade of bonds, and “breaking the buck” (holding less than enough to redeem all deposits) is extremely rare.

From 2008 - ???, money market accounts were offering 0% interest, while CD's provided some small rate of return.

*A common use-case for millionaires. FDIC limits are $250,000 per-institution, per-account owner, per-account type (CD, money market, savings, checking) and my understanding is joint accounts are considered separate owners so two spouses could have up to $750,000 in CDs at a single bank and be fully insured.

30% of households have an aggregate net worth above 250k. So the situation GP in describing is probably very common.

The portion of households that have $250k in the bank is no doubt much less than 30%.

But the majority of that 30% with a net worth above $250k have most of it in the form of their house, not CDs.

I don't believe that most high net worth households are that cash heavy.

I have well over $250k net worth, the vast majority of our assets are in brokerage and retirement accounts. We have only $60k in cash.

I think my credit union expires every 90 days :-/

Reply on news.ycombinator.com