[Cryptography] HSBC's Password Approach: Impressive

[grarpamp]

> They are being pretty clever to make up for terribly endpoint security.

Yeah, all that might work for non brick and mortar stuff you maybe care about,
say email [1], and your fave pornsite. But really... you need to be able to
demand a hardware OTP token from your bank and brokerage... plenty of
cheap open hw exists for that, not RSA, ahem. Any B&M's that don't offer hw
are just using 'clever' obfuscation or cost reduction around the issue of real
security. But since they already cost reduced that nice 4-7% interest they
used to pay you, don't expect this anytime soon. Unless they figure with
real security they could then twist responsibility for that account wiping
transaction to uganda... on you.

[1] Outlook.com uses that stupid 'no cut/paste' thing, worthless and
annoying as fuck for those of us who use real password safes with
real random unmemorizable passwords.