What actual real life person is going to switch their bank account because TOTP isn't supported?
That's why banks get authentication wrong. Because they are in the business of banking and banking customers do not care about TOTP.
Why are banks still getting authentication so wrong?
11–20 of 375 posts
Re: Why are banks still getting authentication so wrong?
#12> And don’t even get me started on logging into accounts at the Canada Revenue Agency.
At least they support standard TOTP now. https://www.canada.ca/en/revenue-agency/services/e-services/...
Re: Why are banks still getting authentication so wrong?
#13So an interesting trick I learned while suffering from the same issue is that roaming usually only applies to outbound data / SMS usage. So when I travel I disable data usage, and set my travel sim to be active and primary, but I can still receive SMS for free.
Re: Why are banks still getting authentication so wrong?
#14UBS Switzerland has a decent system. When I first opened the account 15 years ago we had a number pad of codes on paper we entered as the authentication. Then later we got a credit card sized electronic device where we enter a passcode and it gives us a one-time code to enter to login. And now we have an Access app - we go to the website, enter our contract number, point our phone at a QR code on the webpage and auth…
Banks in the US sometimes support U2F, but you can never disable SMS. Maybe one day.
Re: Why are banks still getting authentication so wrong?
#15I wonder what he would have written if he had his Canadian SIM but his TOTP device got stolen...
Re: Why are banks still getting authentication so wrong?
#16Can we get rid of the password expiration too? Requiring that users change their perfectly secure password every 6 months is absurd and gives the impression of security when in reality it only makes things worse.
Re: Why are banks still getting authentication so wrong?
#17Some banks do it properly. For example, my local credit union does Google Authenticator (actually TOTP, but they call it Google Authenticator). I use it with Authy on F-Droid.
Best thing that ever happened in this bleak security world is Google Authenticator. I haven’t used that app itself in years, preferring others, but the existence of it and it being non-proprietary, has done a lot to bring over the moderately-security-competent companies to thinking “hey, I guess we should support this.” Obviously that group excludes every American bank, every power utility, etc. They all want to email or text me a freaking code at each login for some reason.
Re: Why are banks still getting authentication so wrong?
#18Some banks do it properly. For example, my local credit union does Google Authenticator (actually TOTP, but they call it Google Authenticator). I use it with Authy on F-Droid.
Please do not use Authy, lacks essential features and it was bought by a bad actor.
Is there a way off Authy yet?
Re: Why are banks still getting authentication so wrong?
#19Some banks do it properly. For example, my local credit union does Google Authenticator (actually TOTP, but they call it Google Authenticator). I use it with Authy on F-Droid.
Please do not use Authy, lacks essential features and it was bought by a bad actor.
I recommend KeePassDX from F-Droid for TOTP.
Re: Why are banks still getting authentication so wrong?
#20Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.
It was a proud day when my bank stopped sending emails with links in them. Of course their outsourced fraud prevention dept still calls and leaves messages with callback numbers, or just asks me for PII. Fuck off.
Send people to the website to find your number, idiots.