He didn't "mess with other peoples work". He looked at what his computer was executing. This isn't even like poking at a webpage and telling someone it appears to not validate inputs - the code was running on his own computer.

On top of that, why would you ever feel embarrassed? Perhaps if you posted something very damaging with the sole intent of harming that person, then realised they weren't responsible for the problem.

I recognize this as a possibility and I would definitely take it down if the bank requested it.

On the other hand, if anything, I exposed that they did a good job. They could have rolled out their own crypto, or some flawed form of code generation, in which case I would have disclosed it to them through proper means. But they adhered to standards (TOTP, RFC6238) and protected their data as well as possible. This article should be seen as praise.

Then again, corporations aren't always that understanding, which is why I would be happy to comply.

I agree. If anything, reading this analysis would make me feel /more/ comfortable about the security of this bank's software, not less It seems that they did pretty much everything right, if a bit strangely, in some cases.

TOTP and co. require a private key, just like all crypto. If you have that private key, bad things happen. This is not exactly news at 11.

What was embarrassing about it? You didn't add the security hole to the software.

What security hole?

I think the lesson you were supposed to learn is "responsible disclosure"