Conversation

Notices

1. Dan Gillmor (dangillmor@mastodon.social)'s status on Monday, 09-Dec-2024 01:23:23 JST Dan Gillmor

   My bank uses phone SMS as its standard "2-factor authentication" -- better than nothing at all but GROSSLY insecure compared to encrypted messaging that it refuses to supply.

   I paid extra for an RSA dongle, but when I log in there's an option to use SMS, which makes the dongle completely pointless.

   Crap security is standard in the banking industry -- because contrary to pious words, it doesn't give a damn about your financial privacy.

   https://www.nbcnews.com/tech/security/make-sure-texts-calls-are-encrypted-fbi-security-warning-rcna182810

   • Ryan Finnie (foo@fosstodon.org)'s status on Monday, 09-Dec-2024 01:23:23 JST Ryan Finnie

     in reply to

     @dangillmor My favorite is how most banks have a built in anonymous public remote denial of service feature. Simply enter a wrong password multiple times and the account is locked out! So it's important to keep your password AND username secret and hard to guess.