RE: https://mastodon.social/@neuronakaya/117492242142281404
This, but also, like, don't hand over your bank passwords to anything, period?
0 Boosts
0 Likes
@Geekman I don't know what it is about banks and the fintech sector specifically, but all these “solutions" that "connect to your bank" don’t use anything reasonable like OAuth or API keys and instead just ask you to share your online banking password with them and to disable MFA. It’s mind-boggling.
Also, folks who store their MFA tokens in the same password manager alongside their passwords and are entirely defeating the purpose of the second factor 🤦
@smallsco That has definitely been part of the training.
@smallsco I don't even trust myself with my passwords for that matter. at least 20 character long, randomly generated monstrosities in a N+ factor vault that takes a modern computer a "did I break the computer?" length of time to decrypt.
@retrofan64 Yup, same here.
The annoying thing is when you get a website that doesn't allow 20+ character passwords, or worse, silently truncates the password.
@smallsco This is why my security training courses always include a brief section on why MFA works: a secret ("something you know") is intrinsically a different factor than a physical key ("something you have"). The moment one of these factors is broken, it needs to be reset.
But to your original point: a secret isn't a secret if it's not kept secret. That we need to explain that to people boggles the mind.