What irritates me the most is that, while a lot of sites allow for hardware tokens for MFA, my banks do not. Not a single one of my financial institutions support FIDO or anything like it, opting instead for SMS if they have anything at all. Passwords are usually a maximum length of some small number, and alarmingly, quotes and some other special characters are not allowed. Are they even hashing?
It's insane that my personal blog is more secure than my bank.
IANAL, but as far as I understand, since this month (nov 2025) the DFS (dep of financial services) requires all financial companies to have MFA in force for accessing IT systems (see regulation 500.12).
Not sure how that applies to your situation, but maybe we see some positive movements in this area.
> It's insane that my personal blog is more secure than my bank.
It's insane to imagine that that is true. :)
Seriously though, if banks and their customers were being defrauded by superficially poor password/MFA hygiene, obviously they would fix that. They are not.
I don't think these mass data breaches have anything to do with the security of an individual consumer account.
Something was left open and exposed in the central infrastructure for this to happen, or some kind of supply-chain exploit, or a key administrator account credential was phished.
I agree with you assessment. But if some of my PII was in that breach, which now joins the insane amount of other PII from past breaches, that just makes it that much harder to secure my accounts.
Regardless, I believe my point still stands. I want better options for security; I shouldn't need a better reason than it's where I keep all my money.
Sometime in the 2010s when I was still with BMO, their online banking required you to have a six-digit password. No letters, let alone special characters. And no MFA of course
BMO Investor Line still requires you to have a short password. It explicitly requires, I don't remember the exact number, like, a 6-character password. It cannot be longer. WTF.
Have we gotten to the point yet where simple possession or knowledge of personal data is insufficient to prove identity? Seems like we should have been there years ago.
Why should knowledge of personal data be sufficient to prove identity? When I call my bank, they ask, what is your birth date, as if it isn't basically public info.
What irritates me the most is that, while a lot of sites allow for hardware tokens for MFA, my banks do not. Not a single one of my financial institutions support FIDO or anything like it, opting instead for SMS if they have anything at all. Passwords are usually a maximum length of some small number, and alarmingly, quotes and some other special characters are not allowed. Are they even hashing?
It's insane that my personal blog is more secure than my bank.
IANAL, but as far as I understand, since this month (nov 2025) the DFS (dep of financial services) requires all financial companies to have MFA in force for accessing IT systems (see regulation 500.12). Not sure how that applies to your situation, but maybe we see some positive movements in this area.
>Are they even hashing?
I wonder that with one of my banks, the password is case insensitive. Of course they could lower case it before the hashing but I suspect they don't.
> It's insane that my personal blog is more secure than my bank.
It's insane to imagine that that is true. :)
Seriously though, if banks and their customers were being defrauded by superficially poor password/MFA hygiene, obviously they would fix that. They are not.
I don't think these mass data breaches have anything to do with the security of an individual consumer account.
Something was left open and exposed in the central infrastructure for this to happen, or some kind of supply-chain exploit, or a key administrator account credential was phished.
I agree with you assessment. But if some of my PII was in that breach, which now joins the insane amount of other PII from past breaches, that just makes it that much harder to secure my accounts.
Regardless, I believe my point still stands. I want better options for security; I shouldn't need a better reason than it's where I keep all my money.
Sometime in the 2010s when I was still with BMO, their online banking required you to have a six-digit password. No letters, let alone special characters. And no MFA of course
BMO Investor Line still requires you to have a short password. It explicitly requires, I don't remember the exact number, like, a 6-character password. It cannot be longer. WTF.
Yawn. Another day another breach.
Have we gotten to the point yet where simple possession or knowledge of personal data is insufficient to prove identity? Seems like we should have been there years ago.
Why should knowledge of personal data be sufficient to prove identity? When I call my bank, they ask, what is your birth date, as if it isn't basically public info.