Reverse engineering my bank's security token (blog.valverde.me)

31 points by Ecio78 12y ago ↗ HN

4 comments

[ 2.4 ms ] story [ 31.5 ms ] thread

I'd have to say that TD bank has the worst password reset I've ever seen. You just need the persons access card number, and be able to answer one of 3 question(what's my favorite book ect) and you get to change the password. Doesn't even notify the person.

nwh 12y ago ↗

On the polar opposite, my bank couldn't work out CSRF tokens and so just blanket bans any use of the navigation. Use that back button? Logged out!

junto 12y ago ↗

Previous discussion from about a month ago with lots of comments: https://news.ycombinator.com/item?id=7009368

jrockway 12y ago ↗

Ah yes, RuntimeException for random application-level errors. Always a great practice.