OT Bank relaxes security. Acceptable?

[trader_4]

That they don't know what the site key pic is that you have personally chosen from a long list of available ones and that they don't know the tag line you've personally added to the pic. They aren't going to get that easily. They can get your user name and pwd by creating a fake logon page that looks like BA.

I don't see how it's the perfect method, when the hacker doesn't know the image or tag line for the image that you created.

There are shady

That added step alone isn't going to prevent all the possible ways, no. But without it, I could create a hack webpage that looks like the BA sign on page. So, without it, you put in your logon name and pwd. Now the hack site has both. With the image challenge, you put in your name and if you don't see the correct image and tag line, you know something is up. That's what caused Micky to become concerned, he didn't see the challenge image and his tag line. I think it's a good idea, because with other sites, many times the webpage has changed or the web address that shows up in the address bar seems different, leading me to wonder, is this really Amex, etc? or a hack attempt. With BA, once I see my image, I'm confident it's really BA.

The analogy here would be you call someone and before starting your private conversation, the person you called has to tell you the pass phrase that only you and they know to prove that you've really called them and not someone else.

[Ed Pawlowski]

What is preventing a hacker from getting it? Hackers have been in the Pentagon computers, many stores, banks, insurance companies and on and on. Nothing is truly bullet proof.

If it was that secure, every website would be doing it. Every financial institution would have it. If it makes you feel good, fine, but like every man made puzzle, another man has the solution.

That's what caused Micky to become concerned,

Good for you, it never made me feel any better.

[trader_4]

What's preventing the hacker from getting it is all the security firewalls and procedures at BA. And if they get inside that, then essentially all the security goes out the window, they have all the user names and pwds. Which do you think is harder? Creating a webpage and webpage address that looks like the BA one, to get you to enter your credentials or getting inside BA itself and getting all the user names, pwds, images, etc. It's a well known method that works. Send someone a fake message, claiming to be the bank, taking them to a website that looks like it's the real bank, etc.

I didn't say it was "that" secure. I just said it's a good step so that you know when you see a webpage that it's really your bank and not a hacker making a website that looks like the bank. As I said, I've had many times where the webpage at some financial institution looked different, or the web address looked slightly different. With no challenge image, you don't know. With the addition of that simple image, then you know it's the real bank.

I don't know why that would be. How likely do you think it would be that a hacker would know the image and tag line that only BA has? And if they do, then they surely don't need to be phishing via fake websites, which is what the image challenge prevents.

[Ed Pawlowski]

How hard is it for a hacker to get a screen shot off of your machine?

I'm sure BA is paying big bucks for a security system and if a picture made it secure, it would be there.

[J0HNS0N]

Even if you know my Vanguard user name and password you can't access my account unless you have my phone in your possession. If you don't already take advantage of their 2 step verification, you should.

[J0HNS0N]

I stand corrected then.

In my case I was pleased to find out that I was not just protected for $500K but for ALL of any loss. Although it makes little difference since $500K would have been waaaaaaaay more than adequate.

[trader_4]

IDK, but I do know that hackers go phishing by creating phony websites and it's one of the ways they can easily get your credentials. The pic you know step can eliminate that. Not every security measure will be effective against everything.

Aren't you the guy that just said in a post that nothing is secure, that the hackers could hack BA itself, etc? And again, I'm not saying that the pic makes it secure, only that from everything I see, it certainly adds to security. Clearly BA thought it was worthwhile at one point. Why they changed, we don't know. And already it's upset some of their customers, eg Micky.

[Ed Pawlowski]

Yes, I said that. I still stand behind it, if the site key made it more secure I'm sure it would be there. I think it is of minimal value for protection. Makes you feel good though.

[micky]

Neither hacking nor simple stealilng is fraud.

Fraud: a substantial misrepresentation of fact on which a person is intended to rely and does rely to his detriment. Something like that

-- it's been 40 years.

[micky]

Any financial advisor, except maybe one who works for Vanguard, wil tell you that that is a mistake. You shoudl have a balanced portfolio with not too much money invested in any one thing or any one company.

[J0HNS0N]

He may already have a balanced portfolio (FUND). My Vanguard fund actually has "balanced" in its name because of its diversity of many stocks and bonds.

And if Vanguard fails he and I have $500K protection (right Trader?).

[trader_4]

I don't know why you're focused on fraud. Stealing would be covered by SIPC if the stealing lead to the failure of the brokerage firm and your assets were involved. An example would be if some employee of the firm stole customer funds and it was so extensive that the firm could not cover it, so the firm goes bust. It's not clear to me that SIPC would cover fraud either, unless it again lead to the failure of the firm. If you have a beef over alleged fraud and can prove it, then the firm has to pay it, not SIPC.

[trader_4]

Yes. It's not exactly the picture M paints, ie balance and too much money in one thing. But there is some additional risk in having it all with one mutual fund company. It's theoretically possible that someone could go rogue at Vanguard, run off with all the money, etc. You're right, that if Vanguard could not cover it, failed, etc, then SIPC would cover you up to $500K. But....., while that all sorts out, which could take an undetermined amount of time, you wouldn't be able to access your money, liquidate positions, etc. If you need the money, the market goes south while you're waiting, etc, that could have consequences. With a large player like V, it's extremely unlikely and if they did fail, SIPC, the FED, govt, etc would almost certainly expedite the process, get people at least some liquidity, etc.

[micky]

Some would say you should have some real estate too. Pete said every penny (oops, every dime. That leaves open the possibilty he has 9 cents invested elsewhere.) he had was in funds. I didn't mention this before because I think real estate is a pain, even my own home. (He may own a home too.)

Also, I'm told as one gets close to retirement, the fraction in stocks should go down and the fraction in bonds should go up.

Although there are often stories of banks that fail and the FDIC or some organization shows up on Friday afternoon and they work all weekend and the bank reopens under another name on Monday morning, I'm certain there are also times when functioning is held up for months. Even if he gets every penny plus interest or dividends in the long run, he could spend many months with no access to savings, no vacation trip, no plastic surgery, no travel to a doctor who specializes in exactly what he, his wife, or child needs a doctor for, no house purchase when he finds the house he wants but hasn't sold his old one.

It was the 80s so I don't know if one can find much about Old Court Savings and Loan on the web, but people waited years to get their money. People had to keep working when they would have retired if they had their saving available. Some died before they or their children got their money. If they had no spouse or heirs, the state got it. Even before it failed, the governor had put a limit on withdrawals, just like Greek ATMs, 1000 a month I think.

And I think the whole Federal Savings and Loan Insurance corporatoin failed. I'm not saying those organizations shouldn't exist. They are a good thing. But you shouldn't have all your money in one place counting on them to insure your money and pay you this afternoon when you need the money. You might wait for months.

And although embezzlement was involved in the case above, I don't think it requires fraud or a rogue for a given fund or the whole company to fail. (I was sleeping in 2008 or I'd know more about this.)

NO financial advisor except one who works for the company will tell tell you it's okay to have all your money invested with one company.

[micky]

You would know if you hadn't snipped and forgotten the lines where you yourself said

-- end quote --

These 4 lines were just above the line of mine that you quoted.

[Kurt Ullman]

Vanguard has many mutual funds of many different kinds and Vanguard is generally noted to have the lowest costs (which impacts on return). So, assuming he has some in the Vanguard Big Cap Fund and some in the Vanguard Small Cap Fund and some in the Vanguard Bond Fund and some in the Vanguard Foreign Fund, that should be okay.

[Kurt Ullman]

This was a state chartered bank and part of the problem was that it brought down the Maryland state equivalent.

Just the state run one.

I subscribe to a news letter and know of at least two others that have a portfolio (in the case of the one I subscribe it is called the Gone Fishin' Portfolio) in which they suggest all Vanguard Funds. My newsletter suggests a specific allocation among 11 different funds, but all are Vanguard.

[(PeteCresswell)]

Per micky:

That's what I was told too - by the professional investment advisor that my-neighbor-the-lawyer relies on.

I think the rationale is that as one gets older, liquidity becomes more important and there is less chance that one can ride out negative market fluctuations.

But my reaction was that, with interest rates effectively zero, there is only one direction that bond values can go: down as the hopefully-inevitable rise in interest rates occurs.

So it seems like replacing the short-term uncertainty of stocks with the medium-term certainty that bonds will lose value is not such a clear-cut decision.

I worked as the second-longest-running contractor in Vanguard's history for something like 7-8 years and the reason I stick with them financially is that I know firsthand that they *own* the concept of integrity.

Frankly, they have become something of a PITA to deal with. They don't really want to see you face-to-face, although they will if you insist, but I can live with that because I do not make very many changes.

I also buy into Bogle's spiel about the effect of commissions/fees on one's return - although I guess there are plenty of no-fee funds out there besides Vanguards...

[micky]

Hindsight is 20:20. There are always things that can go wrong.

No, I just checked

"In the 1980s, during the savings and loan crisis, the FSLIC became insolvent. It was recapitalized with taxpayer money several times, with $15 billion in 1986 and $10.75 billion in 1987; however, by 1989 it was too insolvent to save. Pursuant to the Financial Institutions Reform, Recovery, and Enforcement Act of 1989 (FIRREA), the FSLIC was abolished along with the FHLBB, and the FSLIC savings and loan deposit insurance responsibility was transferred to the FDIC. The FSLIC Resolution Fund was created to assume all the assets and liabilities of the FSLIC, which was to be funded by the Financing Corporation (FICO)."

I'll get back to you. At least I plan to.

[micky]

Good point iiuc. This makes me feel better since I've done nothing to reapportion my savings!