11:51 PM | Comment (0)

December 04, 2005

I tend to view most computer-related security concerns with a jaundiced eye. Not saying that malicious hackers and identity theft aren't very real problems. I just believe that the media in its never-ending quest for sensational headlines has made the average person hyper-aware of an issue the vast majority will never even see. The true threat is that paranoia allows corporate dolts to deploy so-called solutions that look great in PowerPpint presentations but in reality simply terrorize users and customers.

Come on, how many passwords do you need in a given day? One site requires four to six characters with a character being a number. That applet wants at least 8 characters with a mix of alpha and numeric and at least one special character. While that system needs six to 10 characters and the password has to be changed every third month but new ones can't be variations of your previous three.

Oy. It's no wonder many of us cope by writing the blasted things down.

Now apparently Bank of America is rolling out a new sign in system. A user name and password aren't good enough. Oh no. Now you need a sitekey. Whatever the hell that is. The instructions state that you enter your user name then press Sign In. If you recognize the sitekey, you know you're at a legitimate bankofamerica.com site and can safely enter your pasword. Bleh.

Yeah I can read between the lines. I recognize this as a PR-fueled attempt to provide the veneer of security against phishing schemes for all those poor souls who can't be bothered to look at much less interpret the information in their browser's address bar. But come on, Mr. Overpaid Security Expert, do we really need another number and code to keep track of?

Of course that's assuming your rube goldergian scheme worked in the first place. I tried to log in to BofA online banking tonight with Safari to dispatch the Visa bill that's due in two days. But instead of a prompt to create a sitekey as the instructions promise, I got a blank browser window and error messages in my status bar. I fired off a complaint email with a none-too-subtle threat to move my accounts and switched to Firefox, which allowed me to log in with the previous user name/password scheme.

End of story, right? If only. It just gets better.

As I'm composing the none-too-brief ditty you're currently savoring every word of, I get a reply to my message. Imagine. Less than an hour after sending. My hopes were dashed though when I opened it and started reading. 1053 words. 12 paragraphs, two distinct bulleted sections and two, yes again, distinct sets of numbered steps, the first with 11 and the second with nine. Obviously a cut and paste monstrosity from several canned responses.

Amusing aside: I did learn that a SiteKey (I'm surprised no one thought to stick a TM on that poor bastardized word.) "can be a minimum of six characters and a maximum of 30 characters long. No special characters are allowed. A special character is any character that requires you to use the Shift key on your PC keyboard before typing the character." A new arbitrary standard. Fun! Now back to the rant.

The gem though is waiting at the very end where I'm told that SiteKey is now a standard part of my online banking experience and can't be deactivated. Right. That explains why Firefox worked the old way.

Something tells me this little case study won't be showing up in a PowerPoint anytime soon.