Kotak Bank has a "new" Netbanking interface they want me to try.
But it does not support password managers or pasting passwords.
I won't use it. It's an asinine design decision.
You want people to reuse passwords? GAH!
My passwords look like this: 6&uEsN@7Cspci5^UAR*g
But it does not support password managers or pasting passwords.
I won't use it. It's an asinine design decision.
You want people to reuse passwords? GAH!
My passwords look like this: 6&uEsN@7Cspci5^UAR*g
What usually happens when I post something like this is that some member of their "social media team" who does not understand anything about security or UX calls me up, listens to my feedback and tells me "feedback will be passed on to development team". And nothing happens.
And if Kotak Bank makes this design the default interface, I will immediately move my business elsewhere. This kind of thing would just be too painful for me to use. I'm not about to start using a password from elsewhere.
Why is disabling password pasting bad?
It prevents password managers that generate random passwords (more secure).
People will then reuse passwords they've used elsewhere.
You should never reuse passwords.
Why not reuse passwords? Keep reading...
It prevents password managers that generate random passwords (more secure).
People will then reuse passwords they've used elsewhere.
You should never reuse passwords.
Why not reuse passwords? Keep reading...
Because websites are regularly breached. Passwords and hashes dumped in the open. (Subscribe to @haveibeenpwned)
If you use the same password for your bank as you used on example.com and that's breached, somebody potentially has a login they could try on your bank.
If you use the same password for your bank as you used on example.com and that's breached, somebody potentially has a login they could try on your bank.
Password managers have features to generate completely random long passwords like T6gZ*b3#Xnyb&2PAnod7 (I just generated that in BitWarden). It remembers it for you. It's almost certain to not be someone's password or the same as you used elsewhere.
The password manager remembers the password for you (and it's encrypted). You just have to remember one master password to unlock your vault.
By disabling pasting passwords and denying the use of password managers, what Kotak Bank has done is force people to remember a less secure password.
Because nobody will remember XVYi*pbkueVc2Sy93v&!
They will use something shitty like Madhu2000!
(Yes, not *all* people.)
Because nobody will remember XVYi*pbkueVc2Sy93v&!
They will use something shitty like Madhu2000!
(Yes, not *all* people.)
In the process, Kotak Bank has just made their banking significantly less secure.
Read this by @troyhunt - The only secure password is the one you can’t remember
troyhunt.com/only-secure-pa…
Read this by @troyhunt - The only secure password is the one you can’t remember
troyhunt.com/only-secure-pa…
Also this: The “Cobra Effect” that is disabling paste on password fields
troyhunt.com/the-cobra-effe…
(A solution to a problem that actually makes the whole thing a lot worse.)
troyhunt.com/the-cobra-effe…
(A solution to a problem that actually makes the whole thing a lot worse.)
Heck, the National Cyber Security Centre in UK recommends allowing people to paste passwords: ncsc.gov.uk/blog-post/let-…
#security #ux
#security #ux
• • •
Missing some Tweet in this thread? You can try to
force a refresh
