I log in to the DBS website to access my corporate banking account. I have to enter the organisation ID, user ID, user password and also a 8 digit number from the 2FA token. It was quite troublesome. to remember so many details - so I have to refer to a printed paper (which is really quite risky). After this procedure, the website hang. I tried 3 times, and it kept getting hang.
I contacted DBS and told me about my problem. Why do they need a 8 digit token number, which was quite difficult to remember (on top of level of details to be entered). The answer - "security". Most banks use 6 digits, which is easier to remember. Eight digits is over-doing the security.
They are not able to explain why their website hang. They did not have the issue with other customers, so it must be my fault. However, I also log in to the website of another bank, and went through easily.
I suspected that the website hang because I was using the Chrome browser. I tried again with Internet Explorer and it went through. It seemed that they have implemented some additional security that caused trouble with Chrome. (Actually, there are websites of several other large organizations with similar problems).
I wish to share this feedback, so that our large business organizations and government agencies are aware about the problems that their online processes are causing to their customers, and how the over-reliance on "security" (usually made at the suggestion of their security consultants) are making the websites quite impractical and difficult to use.
Someone argued that it is safer to have a 8 digit token, rather than a 6 digit token. This argument is ridiculous. The bank only allow the number to be entered a few times. The chance of guessing a 6 digit token correctly is 1 in 1 million. The chance of a 8 digit token is 1 in 100 million. Actually, a 4 digit token (1 in 10,000) is more than sufficient.
ReplyDeleteHowever, I find 6 digit to be okay (as the mind can remember 6 digit - but will make mistakes with 8 digits).