Part of being in the new company involves signing up for insurance, retirement plans, etc... Up until now, everything has worked pretty seamlessly. Seamless, until I logged into my company's retirement plan website. Symantec uses Schwab to manage the 401k's, and I thought that since it's a pretty big company that uses cool, rotoscoped commercials, it should have a decent website. I was wrong.
First, when I log in, I'm presented a menu-like page with links to other functions and information pages. If I click on half of them, I'm logged out of my account. Cookies be darned, I have to log in again to go back.
Second, when something changes, they send me an email to let me know that it has been changed. That's a nice thought, but there are huge flaws with the execution. I will detail them here.
In order to know what changed, I have to open an attached HTML document, enter my username and password, and then they'll tell me. Let me restate, I have to enter personal information into an attached document. This is a huge issue because it just reeks of a phishing scam. I'm sure that the emails I've received are legitimate, but that's not the point. The point is that in this age of the internet, emails are guilty until proven innocent. Any email asking for personal information, especially those with attachments, are not to be trusted.
Oh, here's another kicker. These are the "system requirements" for opening their attached HTML doc:
- An Intel Pentium or equivalent machine
- Microsoft Windows 95, Windows 98, Windows NT or Windows 2000 or Windows XP
- An e-mail client software that accepts attachments
- An e-mail address that accepts attachments
- A Netscape 4.06 (or higher) or Microsoft Internet Explorer 4.01 (or higher) browser
What is this, 1997?
Anyway. I emailed them about how their emails are actually conditioning people to fall prey to phishers. They responded, assuring me in a long paragraph that the data is sent in an highly encrypted manner. While that's nice, it doesn't address my real concern. They're still asking me to enter my username and password in an email attachment. I responded, saying in brief: My issue is not "is my information safe travelling over the internet?", it's "where is my information being sent and can I really be sure that it's being sent to your servers?".
So far, no response.
Boo, Schwab. Boo for training your customers to trust emails completely with their sensitive information.