Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are banks still getting authentication so wrong?

jamal.haba.sh

Post reply on HN
Print view View original

61–70 of 375 posts

Re: Why are banks still getting authentication so wrong?

#61

Post by xienze »

xp84 wrote: post #47
xienze wrote: post #24

I don’t think banks are deliberately trying to avoid using TOTP, it’s just that they have to cater to the lowest common denominator, you know, the kind for which anything computer-related is basically black magic. SMS is an easy target because ~everyone has a cell phone and with things like Apple’s verification code auto-complete, the amount of friction is greatly reduced. With standard TOTP, now they have to worry a…

This is no excuse for not offering it. And no, SMS must NOT be a backup that’s always available, as the article points out, its availability for use is a security hole. If you can’t access your actual 2FA there should be an option for the bank to have it call that registered number and ask you “Hey this is (Bank). Are you trying to log in right now from Moscow on a Windows 10 PC using Firefox? If so, please call the…

> “Hey this is (Bank). Are you trying to log in right now from Moscow on a Windows 10 PC using Firefox? If so, please call the number on the back of your card, hit 9, put in your SSN, then we’ll turn off 2FA for one login and let you add a new one. Btw if it is not you, your password is definitely compromised.”

Stop, do not pass Go, do not collect $200. Having someone call and ask for your SSN is a non-starter.

And in what world is SMS not available but being able to call that same phone is?

Re: Why are banks still getting authentication so wrong?

#62

Post by shadowgovt »

Broadly speaking: because they don't have to get it right.

Banks are generally protected from fraud not by up-front security, but by auditing. If someone mis-applies funds, they have a chain of transactions they can back out. And, if someone does it maliciously, they have a disproportionate support of the force of law to discourage such behavior.

Contrast most software companies, where theft of data is not a reversible issue, so they are heavily incentivized to make it technically infeasible.

Re: Why are banks still getting authentication so wrong?

#63

Post by Muromec »

I think all the banks that I used for the last five years (from three different European countries) use the mobile app itself as a generator of security credentials. The app itself is pin protected.

Recovery paths vary -- from sms and hardware code generator (funny terminal to slot bank card into) to government-managed PKI or id carda.

I think only one of them is still using sms as a fallback for normal transaction confirmations.

Re: Why are banks still getting authentication so wrong?

#64

Post by airstrike »

eptcyka wrote: post #32
bryanlarsen wrote: post #4

Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.

It's stupid to give out credentials over the phone, but it's stupider still to have a system where one's birth date is a credential that is supposed to remain confidential.

Same for SSNs

Re: Why are banks still getting authentication so wrong?

#66

Post by Muromec »

snowwrestler wrote: post #48
chvid wrote: post #29

Identity providing is a natural monopoly and should be provided by the state in same manner as a passport is provided. We can discuss the implementation but in Denmark and quite a few other countries, the login problem in online government services and banking is solved by a single state run identity provider (MitID) and hopefully the EU will be succesful with their EIDAS initiative and provide a solution that works…

In the U.S., identity providing is not a role the government fills. Not everyone has to have a passport, for example. A passport is merely a purpose-specific tool for crossing borders, not general identity.

Federal government or governmemts in general? As far as I get, driver licenses are doing in US what id cards are doing in Europe and are issued by governments too.

Re: Why are banks still getting authentication so wrong?

#67

Post by sedatk »

gtkspert wrote: post #42

You have to think of a Bank's threat model though. Account compromise is one threat, but the use of valid accounts for money laundering is another. In my view the reason they "get it wrong" is because they don't want you to be able to automate transactions, as that makes money laundering easier... Therefore, they don't want to use standard TOTP because that's easy to automate. Requiring SMS based 2FA is harder (but n…

Also, people usually underestimate the problems of TOTP. Losing TOTP is easy. Lose your phone and it's gone. It means game over for a regular person. SMS is light years ahead in terms of ease of recovery. Even after losing your phone, you can stop by a store, activate your SIM back again with your ID. Not the case with TOTP.

Yes, some of the SMS recovery scenarios can make hackers hijack your account easily too, but cell operators have workarounds in place for that. It's getting better.

I don't even know how recovery scenarios work for passkeys.

Re: Why are banks still getting authentication so wrong?

#68

Post by dfxm12 »

gtkspert wrote: post #42

You have to think of a Bank's threat model though. Account compromise is one threat, but the use of valid accounts for money laundering is another. In my view the reason they "get it wrong" is because they don't want you to be able to automate transactions, as that makes money laundering easier... Therefore, they don't want to use standard TOTP because that's easy to automate. Requiring SMS based 2FA is harder (but n…

The banks' real threat model is around what punishments will come from the government. If there's no real regulation with teeth, banks will not care.

Re: Why are banks still getting authentication so wrong?

#69

Post by xyst »

Anybody that has the misfortune of working within a financial institution should know these folks are way behind the times.

They will hire contractors from the bottom of the barrel, claim "rEgUlAtIoNs sToP uS", load up on middle management —- thinking they will ~~whip~~ manage those bottom dollar contractors into performing like well paid folks —- then decry about asinine shit (mUsT rETurN to oFfIcE for cUlTtuRe!!11) and shift blame when the initiative(s) fall flat and projects are behind by _years_.

This rinses and repeats for a few years, maybe they get a half ass implementation out to meet minimum spec for MFA. Maybe they spend millions in consultants and contractors before it gets off the ground.

Post reply on HN