Online banking security

[NXR7]

Windows alerts the user if there is any attempt to add a certificate to the trusted root store.

Unfortunately not, just for those added manually. Think about it. Microsoft can add missing root certificates automatically and without you even knowing about it. That means there is a programmatic method to add certs without notifying the user. And there is.

Ray

 

[NXR7]

The idea that financial firms keep passwords in a database is wrong. They store hashes of the passwords, with salting. So even if an attacker cracks the whole database they don't get the passwords. They get the salted hashes that can't be backward calculated.

Yeah, that would be nice but it's not even close to accurate. MANY companies still use encryption instead of hashing or use weak hashes like MD5 or SHA1. Or they keep the salt in the same table row with the salted, hashed password. I've seen that one often enough to become depressed.

Ever had a company email you your password in response to a "Forgot password?" request? Yup, they may store it as gibberish but they can reverse it and so can anyone else.

Many, many FI's use mainframes and OMG, some of those are the worst because they're so old. Just think about migrating off a mainframe to something else or doing a major upgrade without messing up any of the data (meaning people's money).

Even worse, people take shortcuts. You can require completely separate credentials for a person's work PC and their mainframe access and more often than not they will use the same password on both. Crack their Windows password and you now have their mainframe password.

Ray

 

[jim584672]

So here is the issue: How do you define "secure"?

For a protection mechanism to be considered secure it must not fail or be cracked as long as the data has value.

For a company's quarterly SEC filings, they need a protection mechanism that can withstand hacking attempts until they file the report, maybe three months.

For an SSN, it's a person's lifetime, right?

Ray

AES256 with a good 32 char password is right now not brute forceable, it would take millions of years. AES is quantum resistant and it it might cut the time in half, which is still million of years.

Quantum computers would ruin current asymmetric RSA, ECC but they are working on quantum resistant alternatives.

 

[NXR7]

For the past ten years of so we have used on line wireless banking on our travels. On just about every continent, in places like London, Sydney, Bangkok, and in back of beyond locations in Africa, SE Asia, South/Center America etc. Same for ATM access.

Never been hacked or had our credit card compromised in any travel location. Our credit cards were have been hacked at home a few times though.

But, are careful to keep our travel bank account separate for other accounts by using a separate institutions.

Great advice there. You mentioned "credit cards" so let's talk about "debit cards".

A stolen credit card cannot drain your bank account. A stolen debit card can. Most banks will take up to ten business days to investigate and maybe return your money, during which payments can fail.

If you absolutely must use a debit card, and I will not have one, have a separate bank account for the debit card. It can be at the same bank as your main account. Transfer enough money online from your main account into the debit card account for it to work, but not much more.

If the debit card gets stolen the criminal can only drain the debit card account, not your main account.

I worked way too many debit card account clean-outs to ever use one for myself.

Ray

 

[NXR7]

Hopefully people are being more clever than 23.2 million other people: ...

Think your password is unique? Try it out: https://haveibeenpwned.com/Passwords

You also can check to see if your email address has been exposed in a breach. Troy Hunt, the operator of that site, has been vetted by the best and the brightest.

Oh, and I would never put a current password into any password checker site but I have put old ones in.

Try Maryhadalittlelamb

Oh yeah, and many sites will accept a space as part of a password as long as it's not at the beginning or the end.

Ray

 

[NXR7]

Thanks, I never thought of using that character set, going to have to try it

So funny story time. The pen testers wanted to know how I made my password uncrackable so I changed it to one that I could show them.

I typed it into Notepad before they arrived, showed them, and copied and pasted it in and it worked. The password:

My password 1234

So they tried to crack it from the test system and couldn't crack it. They then typed it and it wouldn't work. But when they copied and pasted it, it worked.

Why? The character between the "y" and the "p" and between the "d" and the "1" is not a space.

It's an ALT 255 or NULL character but visually it looks like a space.

Ray

 

[NXR7]

AES256 with a good 32 char password is right now not brute forceable, it would take millions of years. AES is quantum resistant and it it might cut the time in half, which is still million of years.

Quantum computers would ruin current asymmetric RSA, ECC but they are working on quantum resistant alternatives.

I wish I had a dollar for how many times I've read a similar statement about other algorithms in the past.

One place every use of that statement falls apart is that they all assume the very last key left standing is the right one. In other words, every single combination was tried until only one possibility is left and that was it. The real world does not work that way.

Anyway, any competent attacker knows the best way to break encryption is to not break it. Get malware such as a keystroke logger on the computer where the password is typed and intercept it at that point. Humans are a lot easier to hack than computers, usually.

Ray

 

[jim584672]

I wish I had a dollar for how many times I've read a similar statement about other algorithms in the past.

One place every use of that statement falls apart is that they all assume the very last key left standing is the right one. In other words, every single combination was tried until only one possibility is left and that was it. The real world does not work that way.

Anyway, any competent attacker knows the best way to break encryption is to not break it. Get malware such as a keystroke logger on the computer where the password is typed.

Ray

A 256 bit key space is 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936 combinations. The sheer size is what makes it uncrackable. I guess you could get lucky, just not likely.

 

[tango2]

I just read on Komando that “last pass “ had 7 trackers on its’ site and then sold the personal info to ad agencies. So be careful with it. She did not say any security was breached

 

[Lsbcal]

I just read on Komando that “last pass “ had 7 trackers on its’ site and then sold the personal info to ad agencies. So be careful with it. She did not say any security was breached

I think they are referring to just the Android version of LastPass.

 

[target2019]

Free security courses and content here:
https://www.nist.gov/itl/applied-cybersecurity/nice/resources/online-learning-content

National Institute of Standards and Technology (NIST) is the seat of many security standards.

 

[sengsational]

Ever had a company email you your password in response to a "Forgot password?" request? Yup, they may store it as gibberish but they can reverse it and so can anyone else.

I'd like to advise the readers here that, although some posts have lots of convincing buzz words, I would not put any faith in some posts. For instance, the idea that any site that's employing best practices can reverse your password is not the way it works. They run what you type in through a one-way hash, and compare that to what they have in their database. The hackers can have the database, the salt, the algorithm and still not reverse your password.

Anyway, any competent attacker knows the best way to break encryption is to not break it. Get malware such as a keystroke logger on the computer where the password is typed and intercept it at that point. Humans are a lot easier to hack than computers, usually.

There's one thing I agree with, and notice it doesn't involve knowing anything about crypto.

Free security courses and content here:
https://www.nist.gov/itl/applied-cybersecurity/nice/resources/online-learning-content

National Institute of Standards and Technology (NIST) is the seat of many security standards.

Everyone, even those that claim to know about cyber security, should brush up. So much BS floating around.

 

[Lsbcal]

I don't really know anything about the internals of security and am just an informed user. Best practices count.

I would bet that everyone posting here has way way better security practices then the average American. The crooks are almost sure to go after the careless users.

Still it's fun to speculate on all that cyber jargon.

 

[tulak]

I'd like to advise the readers here that, although some posts have lots of convincing buzz words, I would not put any faith in some posts.

+1. There’s a good number of incorrect statements here that may seem plausible by someone who isn’t familiar with security/crypto.

 

[target2019]

Free security courses and content here:
https://www.nist.gov/itl/applied-cybersecurity/nice/resources/online-learning-content

National Institute of Standards and Technology (NIST) is the seat of many security standards.

I'd like to advise the readers here that, although some posts have lots of convincing buzz words, I would not put any faith in some posts. For instance, the idea that any site that's employing best practices can reverse your password is not the way it works. They run what you type in through a one-way hash, and compare that to what they have in their database. The hackers can have the database, the salt, the algorithm and still not reverse your password.

There's one thing I agree with, and notice it doesn't involve knowing anything about crypto.

Everyone, even those that claim to know about cyber security, should brush up. So much BS floating around.

+1. There’s a good number of incorrect statements here that may seem plausible by someone who isn’t familiar with security/crypto.

Yes, yes, yes. To contrast with Financial Knowledge, the forum spends a lot of time dissecting every crackpot theory, and knowing certain basics inside out (like Roth conversion rules). If someone misses an obscure detail, it it called out and corrected the same day.

I think some are building upon computer fallacies, and going further. Computer networking is a good example of that too.

Technology subjects are really tough if you've not been close to IT subjects over the years. Having studied many tech subjects as part of various jobs I'm aware of the components that go into understanding the way things work, even when you can't see the process or components.

I know anyone can acquire baseline information from courses and books that explain important subjects in the proper way. Even if you just chew on one fact a day it can help. For example, locking an account after X failed attempts is part of every security system. The setting has to be included since it is essential. Knowing this you can understand another security setting that controls the lockout period you're hit with when failing your login.

It's not that I know so much, it's that I know what I don't know and still look for facts.

 

[Lsbcal]

Well I make sure that everything I say here will stand up in a court of law.

 

[tulak]

Well I make sure that everything I say here will stand up in a court of law.

Just for the record, my comment wasn't directed to you.

I realize my response wasn't that helpful, beyond pointing out that you shouldn't believe everything you read in this thread, since there's a lot of misleading/wrong statements.

In trying to be helpful, I'll share what I do.

For passwords:

1. Use a password manager.
2. Use 2FA on sites that matter (financial sites, e-mail).
3. Use e-mail for 2FA if you can.
4. Remember two passwords: one for your password manager and the other for your primary e-mail, the one that you use for 2FA and other notifications.
5. Do not include your e-mail password in your password manager.
6. Use unique passwords for all sites that matter. This should be trivial, since you have a password manager. An example where I don't care are video streaming services.

When I'm not at home:
1. Only connect to sites that I care about over the cell network or use a VPN to connect to my home network. Avoid connecting to important (financial) sites using public wifi.
2. I consider using a VPN provider useless for security. Save your money. The only benefit for a VPN is if you want to be in a different location to avoid region blocking sites. My opinion here differs if you use a VPN connecting to your own network, which is nice if you can set it up easily.

I install a minimum amount of software on my computer to avoid any malware, which I consider a bigger risk. I also don't use any web browser extensions, except for a password manager. Yep, no ad-blocker, even though I occasionally use a pi-hole which is a better approach to avoid ads (and other stuff).

Oh, I also make it a point to check my e-mail frequently. Usually it's multiple times daily, which is easy to do on a smartphone. If anything nefarious happens, I'll get an e-mail. As already mentioned, most sites - such as Vanguard - know what device you're connecting from. If an unknown device is used, they'll ask for additional validation. That works well in preventing unauthorized logins from other devices, even if someone has your password. For almost all transactions that matter, I'll get an e-mail.

The reality is if someone gets your password, odds are they won't be able to do much with your account if it's properly secured. And if you use unique passwords everywhere, the hassle of changing a single password isn't that great. It's much harder to deal with compromised credit card numbers.

 

[albundyz]

prev posters, thanks for some very valuable information, if any of you are still watching I have a question.

I log on to Vanguard often. I always use the same laptop and always from home. About every 4th or 5th time, they send me a secret code to my cell phone and won't let me log on until I enter the code. What triggers this? I assumed that IF I used another device to log on, that might trigger it.... or from a different location? but I use the same device and the same location.... so what triggers the secret code verification?

 

[sengsational]

It could be just the time that has passed, or it could be that your IP address changed. Really could be anything. If it makes you feel any better, that happens to me too. Not as often as every 4th or 5th time, but probably comes out to be every three weeks or a month, I'd say.

 

[Sunset]

prev posters, thanks for some very valuable information, if any of you are still watching I have a question.

I log on to Vanguard often. I always use the same laptop and always from home. About every 4th or 5th time, they send me a secret code to my cell phone and won't let me log on until I enter the code. What triggers this? I assumed that IF I used another device to log on, that might trigger it.... or from a different location? but I use the same device and the same location.... so what triggers the secret code verification?

If you clear up your cookies, and site that uses that to remember you would lose it.
Alternatively, maybe they simply have a rule to check every 4th or 5th time you log in.
I don't know, as I don't want important sites "remembering me" in case they store a cookie on my computer, so I get it every time.

 

[Lsbcal]

I never get an SMS from VG unless I use.a different browser or new PC. You might check your security settings and/or ask a rep if this is annoying.

 

[target2019]

My Vanguard security is set to ask for code every time I log on. These are the choices:

Select frequency
How often do you want to use a security code?

Only when Vanguard doesn't recognize my computer or device.

Every time I log on.

At least for now I have to assume there is no setting for every x login.

Something clears the cookie and you get prompted for a new code. That is actually a good thing.

 

[JustCurious]

Yeah, that would be nice but it's not even close to accurate. MANY companies still use encryption instead of hashing or use weak hashes like MD5 or SHA1. Or they keep the salt in the same table row with the salted, hashed password. I've seen that one often enough to become depressed.

Would it be accurate to say that most financial firms (banks, brokerages) use strong hashes to store passwords?

 

[sengsational]

The idea that financial firms keep passwords in a database is wrong. They store hashes of the passwords, with salting. So even if an attacker cracks the whole database they don't get the passwords. They get the salted hashes that can't be backward calculated.

Yes, we can count on all financial institutions to implement authentication in this manner with an algorithm that, for practical purposes, can't be reversed. Given theft of the hashes and salt, and with knowledge of the algorithm, they could pump common passwords in and look for hash matches. This is why "strong passwords" are always recommended...if your password is "monkey123" you will be toast, where the guy with "G9l&@Q4h" is fine.

 

[jim584672]

Yes, we can count on all financial institutions to implement authentication in this manner with an algorithm that, for practical purposes, can't be reversed. Given theft of the hashes and salt, and with knowledge of the algorithm, they could pump common passwords in and look for hash matches. This is why "strong passwords" are always recommended...if your password is "monkey123" you will be toast, where the guy with "G9l&@Q4h" is fine.

It depends how they arrive at the salt value. The salt is designed to prevent a pre calculated rainbow table attack, which is basically what you are describing. If the salt is unknown to the attacker the hashes are secure.