• laxsill@infosec.pub
    link
    fedilink
    arrow-up
    4
    ·
    9 months ago

    Their policy should just be to reset the password immediately and have the user set a new one. This is one hell of a risk.

    • Z4rK@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      9 months ago

      I still can’t believe American banks lets you login with just username / password? Surely there is some id check or at least two factors involved?

      • icanwatermyplants@reddthat.com
        link
        fedilink
        arrow-up
        2
        ·
        edit-2
        9 months ago

        Nope, several years ago someone complained that their steam account has better protection then their bank account. We’re now in 2023 and that statement still holds. It’s quite scary really. Bank websites that heavily rely on third party scripts ,“MFA” logins based on something you know and something you know. Account verification question based on code words or security questions based on public information. Worst of all, the ignorance of it all. “We got hacked, here have a identity protection bandage, comes with an automatic subscription after several years”.