Hacker News Reader

Comment by supernova87a | Hacker News Reader

At least this is explainable by designers not anticipating hard cases.

I remember the shittiest app from HSBC (who, by the way, seem to be sleepwalking their way through retail banking, with no direction from anyone who cares), which asked:

"What is the answer to your chosen secret question?"

View on HN

It's dumbfounding how awful bank websites are at security. They started with the stupidest conceivable way to implement two-factor--a second clear-text password that is an answer to a very small number of secret questions. Then they limited the secret questions to things people could find out about you on Facebook, then on top of that added secret questions about esoteric crap like your father's mother's childhood neighbor's dog's name, secret questions that have answers that vary over time like your favorite song, secret questions that have ridiculous length or punctuation requirements, authentication by SMS, authentication by robocall, and on and on and on. The only thing they absolutely refuse to try is an actual friggin' two-factor app!

There's security theater, and then there's Punch and Judy security puppet shows.

Don’t forget security images! Don’t put your password in unless you see the random picture!

Our banks in Australia try two-factor apps. Every bank has their own unique one, so phone only and the expected app pollution. And then they push you to using a different app on the same phone for your banking (say by having unique features such as push notifications of credit card purposes), which completely defeats the purpose of the TFA app since you can drain the accounts with nothing but the phone and (if you are lucky) a PIN number.

That's equivalent to asking you to enter a second password. It's OK and more secure than hinting about that password (example: the name of a city, the name of a woman, etc)

I remember that in a similar case I generated a random string with my password manager but I don't remember for which account. I hope it was one for I'll never have to spell that on a phone.

They rightly thought that showing the question could give away the answer, and thus decided to make that secret.

Then why is it even available as a choice?

Then why not just say, "use a 2nd password"? You now have to remember your question, remember the format (with spacing, capitalization, etc) that you used?

Ah, about 12 years ago, in India they used to have people choose two passwords. You would fill out the primary password in full, and then fill in specific characters (1st, 4th, 7th for eg) of the second password as a "second factor." I used to have to type out the full password on an editor and then fill in the right values.

They also sent out a free RSA token for logins when they deprecated this system. It was first sent to "privilege banking" customers like me. And then they forgot that they sent them out, and tried to get me to pay for a new one. They were insistent that the token wasn't sent out at all. Ended up cancelling that credit card.

Reply on news.ycombinator.com