Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

South African bank advises against the use of password managers

twitter.com

Post reply on HN
Print view View original

51–60 of 75 posts

Re: South African bank advises against the use of password managers

#51

Post by nomad010 »

alkonaut wrote: post #47
nomad010 wrote: post #42

Earlier quoted context omitted.

Most transactions require an OTP to successfully complete, you also get notifications whenever a login to your account is performed. I think it would probably be a good idea to have some sort of separate 2FA device linked at home but I doubt they'll ever implement it. You would want it separate to your phone because if your wallet and phone get stolen you can login to the online banking account and deactivate your st…

If the phone has a PIN or similar (I realize not everyone has) and the 2FA app has a pin/password, then that does seem like a reasonable level of security.

No, because getting your phone and wallet stolen (they are likely to both be on your person so both would likely be stolen at the same time) means you couldn't then log on to online banking and deactivate your credit cards (which you would want to do as soon as possible)

Edit: Just to clarify a bit more, most cards here have a tap and go function requiring no PIN up to a certain amount. Although the amount is small I'd still rather have it that no one spends my money.

Re: South African bank advises against the use of password managers

#52

Post by moviuro »

zzzcpan wrote: post #33
moviuro wrote: post #14

Earlier quoted context omitted.

Currently at a bank's security team, here's what I gathered so far that explains (but doesn't excuse) the current state of affairs: - there are millions of customers who hate having to use their brains (or get their phone to receive a 2FA code); - a kilometer of requirements from whatever Central Bank, local policies and ad-hoc decisions; - (too) limited budget to build and run whatever service (cost of SMS 2FA for m…

I guess it depends on the country and the bank. My bank, for example, does mandatory 2FA for 15+ years and uses some anomaly based approach to decide how aggressively to ask for 2FA, like if you send money somewhere unusual, it does phone call 2FA, instead of an SMS, and if you just pay your usual bills from the same IP address and the same PC it doesn't even ask for 2FA at all. It also has other optional security fe…

I'm fiercly in favor of 2FA, and with DSP2[0] coming soon(TM), I have been pushing for sane 2FA at my place, in some select projects where it can be done with as little friction as possible.

I'm very interested in your bank and how they do it, I'll see if voice 2FA is something feasible at my place. Could you share the bank's name though? Management likes to have solid evidence that someone else is already doing it when the security team proposes "weird solutions".

[0] https://ec.europa.eu/info/law/payment-services-psd-2-directi... , https://eur-lex.europa.eu/legal-content/EN/LSU/?uri=CELEX:32...

Re: South African bank advises against the use of password managers

#53

Post by GuB-42 »

zAy0LfpBZLC8mAC wrote: post #45
zzzcpan wrote: post #33

Earlier quoted context omitted.

I guess it depends on the country and the bank. My bank, for example, does mandatory 2FA for 15+ years and uses some anomaly based approach to decide how aggressively to ask for 2FA, like if you send money somewhere unusual, it does phone call 2FA, instead of an SMS, and if you just pay your usual bills from the same IP address and the same PC it doesn't even ask for 2FA at all. It also has other optional security fe…

That sounds terrible. I mean, I assume they don't assume liability for bad decisions? If "the PC" or "the IP address" was not contractually agreed to be an authentication factor (that you thus should protect from unauthorized use), it's a terrible idea to use them for authentication, while also (presumably) putting all liability on the customer.

In France, and I believe it is the case in many countries, in case the customer wants to roll back a transaction, the bank has to give the money back, unless it can prove that the transaction was legitimate.

So basically, they can't put liability on the customer unless 2FA is used. The second factor is usually the credit card PIN.

Banks have to maintain a balance between convenience and risk of fraud.

Re: South African bank advises against the use of password managers

#54

Post by zzzcpan »

zAy0LfpBZLC8mAC wrote: post #45
zzzcpan wrote: post #33

Earlier quoted context omitted.

I guess it depends on the country and the bank. My bank, for example, does mandatory 2FA for 15+ years and uses some anomaly based approach to decide how aggressively to ask for 2FA, like if you send money somewhere unusual, it does phone call 2FA, instead of an SMS, and if you just pay your usual bills from the same IP address and the same PC it doesn't even ask for 2FA at all. It also has other optional security fe…

That sounds terrible. I mean, I assume they don't assume liability for bad decisions? If "the PC" or "the IP address" was not contractually agreed to be an authentication factor (that you thus should protect from unauthorized use), it's a terrible idea to use them for authentication, while also (presumably) putting all liability on the customer.

Why would that be a terrible idea? If someone has unauthorized access to my PC and knows my password from the account, he can log in and pay my bills and only the usual amounts, as paying too much would trigger 2FA.

Re: South African bank advises against the use of password managers

#55

Post by sonnk »

mcv wrote: post #20
sonnk wrote: post #12

Earlier quoted context omitted.

I can understand if a government service requires this but it also happens with a normal, ecommerce website!

I do not understand why a government service would require this. Governments should improve security, not undermine it. (Then again, most governments don't seem to care much about what I think they should be doing.)

The generated password is usually just random string and hard to memorise. If you need to use the password outside of the web, e.g. on telephone or in a physical office, then it makes sense to use a password you creates. This is similar to the "master password" used by password manager, you should remember it by heart instead of generating a random one.

Re: South African bank advises against the use of password managers

#56

Post by moviuro »

vxNsr wrote: post #32
mikeash wrote: post #5

“Bank has idiotic ideas about security” is as surprising as “sun rises at predicted time.” Something about the industry seems to push paranoid incompetence in security.

The most confusing thing is that a lot of banks (paypal included) still don't let you use "special chars" in your password. Or they will allow it but only for a very limited set that they don't tell you.

That's not true about Paypal though: "Use lower case, upper case, a number, and a special character [like ~!@#$%^&*()_+=?>And even if the character subset is quite small (26 lower case, 26 upper case, 10 digits), it's still good enough if it's completely random and never leaked once. Just max out the password length (start at 32 char) and back track from there.

[0] https://www.paypal.com/us/smarthelp/article/Tips-for-creatin...

Re: South African bank advises against the use of password managers

#57

Post by alkonaut »

sp332 wrote: post #50
alkonaut wrote: post #46

Earlier quoted context omitted.

No I mean a physical thing like those little number generators that banks have had for what 20 years now, or the smartphone 2FA apps that we have used for at least 15 years. I don't enter either a regular password nor one-time password for anything (not for transactions, not for login). I only use an identifying mechanism on a second device (a smartphone or a dedicated device). The secondary device has an 8digit pin…

Yeah that is a one-time code. It's in the name: https://en.wikipedia.org/wiki/Time-based_One-time_Password_a... And again, if you use only this to log in, it's not two-factor authentication because it's only one factor. You'd have to combine it with something else (like a password or a fingerprint) to have two factors.

The rsa OTP-digit generator thing is an OTP, but what about signing with a device that doesn't generate a visible OTP? My authenticator app just asks me to produce my pin into the smartphone app and then the waiting transaction completes automatically in the computer web browser.

I suppose it could be an OTP too, but just not "manually entered"?

Is there a name for this type of authentication? It's just one factor but I do it on a separate device I mean.

Re: South African bank advises against the use of password managers

#58

Post by alkonaut »

nomad010 wrote: post #51
alkonaut wrote: post #47

Earlier quoted context omitted.

If the phone has a PIN or similar (I realize not everyone has) and the 2FA app has a pin/password, then that does seem like a reasonable level of security.

No, because getting your phone and wallet stolen (they are likely to both be on your person so both would likely be stolen at the same time) means you couldn't then log on to online banking and deactivate your credit cards (which you would want to do as soon as possible) Edit: Just to clarify a bit more, most cards here have a tap and go function requiring no PIN up to a certain amount. Although the amount is small I…

That's a good point. I have done it a few times and it can be done quickly by phone at least.

Re: South African bank advises against the use of password managers

#59

Post by sp332 »

alkonaut wrote: post #57
sp332 wrote: post #50

Earlier quoted context omitted.

Yeah that is a one-time code. It's in the name: https://en.wikipedia.org/wiki/Time-based_One-time_Password_a... And again, if you use only this to log in, it's not two-factor authentication because it's only one factor. You'd have to combine it with something else (like a password or a fingerprint) to have two factors.

The rsa OTP-digit generator thing is an OTP, but what about signing with a device that doesn't generate a visible OTP? My authenticator app just asks me to produce my pin into the smartphone app and then the waiting transaction completes automatically in the computer web browser. I suppose it could be an OTP too, but just not "manually entered"? Is there a name for this type of authentication? It's just one factor bu…

Oh I see. Yeah Microsoft's authenticator app can do that, but they use it as a second factor. I don't know the details but I'd guess that it's not time-based but some kind of challenge.

Another option is Tumblr's "magic link", where they email you a link that logs you in. That's one of the few places I've seen something like that used as a single factor.

Re: South African bank advises against the use of password managers

#60

Post by zAy0LfpBZLC8mAC »

zzzcpan wrote: post #54
zAy0LfpBZLC8mAC wrote: post #45

Earlier quoted context omitted.

That sounds terrible. I mean, I assume they don't assume liability for bad decisions? If "the PC" or "the IP address" was not contractually agreed to be an authentication factor (that you thus should protect from unauthorized use), it's a terrible idea to use them for authentication, while also (presumably) putting all liability on the customer.

Why would that be a terrible idea? If someone has unauthorized access to my PC and knows my password from the account, he can log in and pay my bills and only the usual amounts, as paying too much would trigger 2FA.

Because there is a risk associated with it that you didn't agree to.
Post reply on HN