Banking - online; save my logon details?

[ChrisGreaves]

There are many different forms of online banking (bank competion?) but most seem to rely on 2FA.

Hi Ron.
Taking 2FA as it stands, I am happy with it.
It seems to me that the greater the number or variety of channels of communication, the better; even to the extent of using the voice telephone to confirm details.

2FA isn't the problem that I perceive.

It is the availability of a second technology ("Save your logon details?") that seems to me to be in conflict with the idea of 2FA (protect your ability to login?") that raises a red flag to my eyes.

2FA makes it more difficult for anyone else to log in.
"Save details" makes it less difficult for anyone else to log in.

Each person has different requirements for security.
My requirements are different from yours (because we are different people!)
When I made extensive use of cafes and libraries for online access, or when I worked in a corporate headquarters, I was more concerned about security than I am now.

Perhaps I should consider this as a spectrum of security.
At my end is very low security: an Encrypted data partition, but a wide-open laptop apart from that. Any stranger can walk into my house and start using the web.
At the far end is how I used to be when I had gigabytes of confidential client projects sitting on my computers.

Each "wall of security" from Windows login through decryption login through stored bookmarks, stored passwords etc is another hurdle for Billy Burglar to work through. Same thing, in truth, with my electricity bill. Four wooden doors are closed between where I sit and The Great Outdoors, because we are in mid-winter. As summer approaches more doors are opened until by summertime (August 6th through 13th) I am, in effect, working outside.

'Twould be interesting to read what online banking technicians feel about "Save your login?"

Cheers, Chris

[ChrisGreaves]

Having FF or any browser save passwords does nothing to thwart 2FA.

Hi Jay. I agree. The two technologies are not connected. except through my preference for saved logins.

In my response to Ron I suggested that "2FA" and "saved logins" were like having TWO hurdles which must be jumped in series in order to reach an online account, whereas removing "save login", or removing "2FA", means that overall there is a less stringent check.
Imagine a third hurdle - the online site calls you on a voice number and says "Chris, are you trying to log in", and compares the waveform of your response "Yes" with a stored waveform. A fourth hurdle might be a thumbprint.

My (minor) objection is that some institutions offer 2FA only by text message, which is technically easier to intercept than email, and most don't offer authentication app support at all.

This is what I met with (I think it was) EQ bank. That caused me to hunt around and thus I found Motus Bank, whose 2.5% interest rate was double that of EQ bank. So in a sense, EQ's 2FA lost them a customer!

Cheers, Chris

[RonH]

Interesting thoughts Charles.

What amazes me these days is the many varied approaches to security in eg banking. Isn't a bank a bank a bank where mostly they offer customers similar banking services. Even here in Norway all the (few) banks approach security differently making many differing hurdles for folk to jump over.

Public transport ... they have been developing cards/apps for quite some period here and still I cannot go online to check if they have correctly recorded my journeys and priced according. I should mention that I use a card and not the app because I have seen folk struggling to 'open' app to do whats needed when it's freezing cold ... age and shaking hands doesn't help!

Yet one can take a vacation in say Singapore, Hong Kong, Japan etc. easily get a travel card and when leaving the country get any remaining balance refunded. But travel in the London network and you can't get any balance over £10 refunded . at least that was the case when I last visited. Same in Vic Australia.

It must be a case of software competition which is OK if it results in improving customer security or service. But to me it seems that 'pride' comes much into 'let's do things differently', often resulting in a....

Just my pennyworth

[ChrisGreaves]

...Isn't a bank a bank a bank where mostly they offer customers similar banking services.

Hi Ron. Never mind security. What about the dozens of different ATMs and debit-card machines we encounter each year? I have to engage my brain each time I buy something using one of two debit cards or one of two credit cards.
I mean, use the <F1> key, or use the on-screen <F1> key, but don't chop and change.

While the banks were scrambling to locate a "better" ATM than everyone else, no Canadian bank that I have encountered thought to install code that recognised that each Friday afternoon at 5pm I withdrew $100 cash from the same ATM at the corner of Bay and College streets, and allowed me to skip all the button-pressing and act with the intelligence of my local cafe who began pouring an Americano as soon as I loomed into sight each morning at 8:30.
Let alone offer a drop-down menu of "Your most recent transactions" so that I could gust scroll-and-tap.

Public transport ... they have been developing cards/apps for quite some period here ...

Be glad that you don't live in Toronto where about six years ago they rolled out The Presto Card. Except that the TTC (Toronto city transit) implemented Presto quite differently from commuter rail (GO Transit). When you tap on Commuter rail the screen shows your new balance (i.e. How are you going to get home) but when you tap on the city transit buses or streetcars, the system just beeps and lights up green.
I have written extensively on public transit failings.

Yet one can take a vacation in say Singapore, Hong Kong, Japan etc.

Of course you can hop off the 'plane at CDG and get a Navigo card update/refill for all 5 zones of the Île-de-France for one month and then the entire region (10,000 sq km?) is yours; every suburban train on SNCF rails, RER, bus and tram in the region for about €70 (2016?). Which to my mind is so cheap that it doesn't warrant asking for a refund

It must be a case of software competition which is OK if it results in improving customer security or service. But to me it seems that 'pride' comes much into 'let's do things differently', often resulting in a....

I think not. You can have a hundred versions of software to achieve your goals, but you might also try to adopt a standard. That in the sense that I am better of using VBA code suggested in Eileen's Lounge than write my own. At least with my "borrowed" code, some other people will be able to read it.

We used to teach programmers to make use of an existing standard rather than devise their own.

Cheers, Chris

[stuck]

...We used to teach programmers to make use of an existing standard rather than devise their own...

https://xkcd.com/927/

[ChrisGreaves]

https://xkcd.com/927/

I like his cartoons; they are always on-the-spot, be it science or technology.
Cheers, Chris

[ChrisGreaves]

... no Canadian bank that I have encountered thought to install code that recognised that each Friday afternoon at 5pm I withdrew $100 cash from the same ATM at the corner of Bay and College streets, and allowed me to skip all the button-pressing ...

I squoke too soon.

2023_02_IMG_20230127_110640755.jpg

Not a good photo because they were people lined up behind me who, I suspect, were thinking "Greaves is a dope; the ATM will PRINT a receipt if you ask it to", but there is "Favourite Transactions" showing at the foot of the screen.

Next time, if there isn't a line-up at Bonavista's favourite ATM I shall try setting up for myself a Favourite Transaction, and see if it reduces my keystrokes.
Cheers, Chris