Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are banks still getting authentication so wrong?

jamal.haba.sh

Post reply on HN
Print view View original

51–60 of 375 posts

Re: Why are banks still getting authentication so wrong?

#51

Post by martinald »

The reason it's a farce is because most banks are using some off the shelf system from one of the big vendors in the space OR legacy systems, or both. FIS is a good example.

They have basically no real motive to improve anything (the lock in is utterly extreme) and no doubt will charge through the eyeballs for any improvements - especially ones that are regulatory related.

You can see the difference between a legacy bank and some of the neobanks in the UK. It's absolutely night and day when they own their own modern tech stack.

Re: Why are banks still getting authentication so wrong?

#52

Post by dfxm12 »

bryanlarsen wrote: post #4

Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.

I had someone ask for my name. I told them my first and last name. They said it wasn't correct. After a few minutes of discussion, it turns out the person wanted my name as it appeared on my card, which is first name, middle initial, last name and a suffix. I told the person as feedback that what they asked for and what they wanted were two different things. I'm not optimistic that anything will change.

Re: Why are banks still getting authentication so wrong?

#53

Post by saltcured »

pnw wrote: post #22

OP's problem sounds like failure to plan. If you are going to suspend your cell plan, you should probably check your authenticator works or have a backup option before you travel to another country. I don't know what the viable alternative is. Passkeys have just as many issues when phones are stolen, lost or broken. You cannot expect consumers to store recovery codes. I do agree support of TOTP authenticators would h…

One thing I like about the Aegis authenticator app is the clear way it changes colors and even flashes to indicate a code is getting ready to change, so it is less common that you might start copying digits, glance away, and then finish copying digits from a different code.

But, I think it would still be a challenge for many elderly for other reasons.

Re: Why are banks still getting authentication so wrong?

#54

Post by newhotelowner »

kokonoko wrote: post #16

Can we get rid of the password expiration too? Requiring that users change their perfectly secure password every 6 months is absurd and gives the impression of security when in reality it only makes things worse.

Our hotel franchise requires us to change the password every month. We can't use the last 6-8 passwords.

Re: Why are banks still getting authentication so wrong?

#55

Post by riffraff »

chvid wrote: post #29

Identity providing is a natural monopoly and should be provided by the state in same manner as a passport is provided. We can discuss the implementation but in Denmark and quite a few other countries, the login problem in online government services and banking is solved by a single state run identity provider (MitID) and hopefully the EU will be succesful with their EIDAS initiative and provide a solution that works…

italy has quite an interesting system[0] where multiple identity providers (authorized by the State) can be used to provide identification against the central database. It'll probably be phased out at some point, but it's quite cool.

[0] https://www.spid.gov.it/en/citizens/ it integrates with eIDAS too

Re: Why are banks still getting authentication so wrong?

#56

Post by bouncing »

The problem with the suggestions here is that it puts all your eggs in the same basket. 1Password TOTP? If both your password and the TOTP are in your password manager, you arguably really just have a single factor, delegated to a third party (your password manager). PassKeys? Same problem. Storing your recovery keys in your password manager? You again just have 1 factor.

SMS is bad and should go away, but it isn't so clear what the replacement needs to be for most people.

Re: Why are banks still getting authentication so wrong?

#58

Post by Pikamander2 »

bryanlarsen wrote: post #4

Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.

My dad recently got a letter telling him that his bank account would be closed in 30 days if he didn't call the phone number listed on the letter.

Upon calling the number, you get an automated system that immediately asks for your social security number and won't let you proceed until you do.

The phone number was nowhere to be found on the bank's website nor did it appear in a single Google result.

Sounds like an obvious scam, right? Nope. It was genuinely one of the bank's official phone numbers, and I had to nag them through three separate channels to get them to add it to their website, which they did a week later.

Re: Why are banks still getting authentication so wrong?

#59

Post by xienze »

Zak wrote: post #50
xienze wrote: post #24

I don’t think banks are deliberately trying to avoid using TOTP, it’s just that they have to cater to the lowest common denominator, you know, the kind for which anything computer-related is basically black magic. SMS is an easy target because ~everyone has a cell phone and with things like Apple’s verification code auto-complete, the amount of friction is greatly reduced. With standard TOTP, now they have to worry a…

> With standard TOTP, now they have to worry about if the user correctly added the secret The standard flow I usually see for setting up TOTP ends with entering an authentication code. If it's not valid then the setup isn't finished.

That's not what I'm talking about. I'm talking about the act of adding the secret to the authenticator app in the first place. There needs to be documentation to the effect of "open Google Authenticator, and if you don't have it, download it on the App Store or Google Play store. Open the app and choose 'new secret', ...". Probably also put in a QR code and link for good measure. Rinse and repeat for all the major authenticator apps. THEN you can have them verify.

It adds up to a decent amount of supporting documentation that the bank is responsible for providing.

Re: Why are banks still getting authentication so wrong?

#60

Post by rrr_oh_man »

newhotelowner wrote: post #54
kokonoko wrote: post #16

Can we get rid of the password expiration too? Requiring that users change their perfectly secure password every 6 months is absurd and gives the impression of security when in reality it only makes things worse.

Our hotel franchise requires us to change the password every month. We can't use the last 6-8 passwords.

Password manager ftw
Post reply on HN