Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are banks still getting authentication so wrong?

jamal.haba.sh

Post reply on HN
Print view View original

81–90 of 375 posts

Re: Why are banks still getting authentication so wrong?

#81

Post by niij »

Pikamander2 wrote: post #58
bryanlarsen wrote: post #4

Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.

My dad recently got a letter telling him that his bank account would be closed in 30 days if he didn't call the phone number listed on the letter. Upon calling the number, you get an automated system that immediately asks for your social security number and won't let you proceed until you do. The phone number was nowhere to be found on the bank's website nor did it appear in a single Google result. Sounds like an obv…

Which Bank?

Re: Why are banks still getting authentication so wrong?

#82

Post by Muromec »

nmca wrote: post #43
pnw wrote: post #22

OP's problem sounds like failure to plan. If you are going to suspend your cell plan, you should probably check your authenticator works or have a backup option before you travel to another country. I don't know what the viable alternative is. Passkeys have just as many issues when phones are stolen, lost or broken. You cannot expect consumers to store recovery codes. I do agree support of TOTP authenticators would h…

hardware tokens are the way! Everyone has had a house key their whole lives, and understands how to keep a spare to prevent lock-outs.

If only there was some kind of a physical tokem with a crypto key that is protected by a password and tied to one's bank account.

-s

Re: Why are banks still getting authentication so wrong?

#83

Post by gruez »

gtkspert wrote: post #42

You have to think of a Bank's threat model though. Account compromise is one threat, but the use of valid accounts for money laundering is another. In my view the reason they "get it wrong" is because they don't want you to be able to automate transactions, as that makes money laundering easier... Therefore, they don't want to use standard TOTP because that's easy to automate. Requiring SMS based 2FA is harder (but n…

The biggest hurdle to money laundering is getting past KYC at the creation stage, which requires you to have stolen identities and/or identity documents, getting past the anti-fraud gauntlet, and probably intercepting any documents/cards that get mailed. Setting up a device farm that can receive SMS OTPs is simple by comparison. All you need as a $60 android phone and an app with SMS access.

Re: Why are banks still getting authentication so wrong?

#85

Post by gruez »

charcircuit wrote: post #77
gtkspert wrote: post #42

You have to think of a Bank's threat model though. Account compromise is one threat, but the use of valid accounts for money laundering is another. In my view the reason they "get it wrong" is because they don't want you to be able to automate transactions, as that makes money laundering easier... Therefore, they don't want to use standard TOTP because that's easy to automate. Requiring SMS based 2FA is harder (but n…

Why would a bank care about money laundering?

If they're not seen as doing enough, they can be fined by regulators.

Re: Why are banks still getting authentication so wrong?

#86

Post by error503 »

clay10 wrote: post #38
poisonborz wrote: post #9

Earlier quoted context omitted.

Please do not use Authy, lacks essential features and it was bought by a bad actor.

I switched from Lastpass Authenticator to Authy after the hack. The lack of the "upcoming key" feature has been a huge paint point. Any suggestions for what is better?

Try Aegis https://getaegis.app/

Re: Why are banks still getting authentication so wrong?

#87

Post by bloqs »

Pikamander2 wrote: post #58
bryanlarsen wrote: post #4

Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.

My dad recently got a letter telling him that his bank account would be closed in 30 days if he didn't call the phone number listed on the letter. Upon calling the number, you get an automated system that immediately asks for your social security number and won't let you proceed until you do. The phone number was nowhere to be found on the bank's website nor did it appear in a single Google result. Sounds like an obv…

Which bank....

Re: Why are banks still getting authentication so wrong?

#88

Post by sedatk »

sneak wrote: post #71
sedatk wrote: post #67

Earlier quoted context omitted.

Also, people usually underestimate the problems of TOTP. Losing TOTP is easy. Lose your phone and it's gone. It means game over for a regular person. SMS is light years ahead in terms of ease of recovery. Even after losing your phone, you can stop by a store, activate your SIM back again with your ID. Not the case with TOTP. Yes, some of the SMS recovery scenarios can make hackers hijack your account easily too, but…

Precisely nobody is suggesting that there be no recovery mechanism. This criticism is a red herring.

What do you think such a recovery mechanism would look like without SMS?

Re: Why are banks still getting authentication so wrong?

#89

Post by craftkiller »

Muromec wrote: post #82
nmca wrote: post #43

Earlier quoted context omitted.

hardware tokens are the way! Everyone has had a house key their whole lives, and understands how to keep a spare to prevent lock-outs.

If only there was some kind of a physical tokem with a crypto key that is protected by a password and tied to one's bank account. -s

The only bit we're lacking is the "tied to one's bank account". The rest already exists in the form of yubikeys and other hardware security tokens.

Re: Why are banks still getting authentication so wrong?

#90

Post by error503 »

xp84 wrote: post #47
xienze wrote: post #24

I don’t think banks are deliberately trying to avoid using TOTP, it’s just that they have to cater to the lowest common denominator, you know, the kind for which anything computer-related is basically black magic. SMS is an easy target because ~everyone has a cell phone and with things like Apple’s verification code auto-complete, the amount of friction is greatly reduced. With standard TOTP, now they have to worry a…

This is no excuse for not offering it. And no, SMS must NOT be a backup that’s always available, as the article points out, its availability for use is a security hole. If you can’t access your actual 2FA there should be an option for the bank to have it call that registered number and ask you “Hey this is (Bank). Are you trying to log in right now from Moscow on a Windows 10 PC using Firefox? If so, please call the…

Recovery codes is an option, for one.

Since we're talking about a legacy bank here, going to a branch and proving your identity is an option.

Worst case, you could always call and speak to a human who will do whatever verification they do if you forgot your password, which is functionally equivalent.

Post reply on HN