I wonder what he would have written if he had his Canadian SIM but his TOTP device got stolen...
Good question, that’s exactly why systems need multiple secure fallback options.
Why are banks still getting authentication so wrong?
91–100 of 375 posts
Re: Why are banks still getting authentication so wrong?
#92Earlier quoted context omitted.
In the U.S., identity providing is not a role the government fills. Not everyone has to have a passport, for example. A passport is merely a purpose-specific tool for crossing borders, not general identity.
Federal government or governmemts in general? As far as I get, driver licenses are doing in US what id cards are doing in Europe and are issued by governments too.
In the US you don't need to have any form of ID. Your life will be very difficult, but you don't legally need it. ID is an optional service here.
Re: Why are banks still getting authentication so wrong?
#93I remember my brother having a printed list of one-time-codes. I wonder why this is not mentioned? Not everyone wants to have their phone a single-point-of-failure. For me - breaking screen in my phone rendered my banking unavailable for me, which posed additional problem on how to pay for the screen replacement, not speaking about buying food etc.
Re: Why are banks still getting authentication so wrong?
#94Earlier quoted context omitted.
Precisely nobody is suggesting that there be no recovery mechanism. This criticism is a red herring.
What do you think such a recovery mechanism would look like without SMS?
Syncing the TOTP credentials from a cloud account of some sort (iCloud/Google for the masses, Bitwarden or another password manager for more technical users) to the device.
As a fallback recovery mechanism, offline backup codes generated at the time the TOTP is applied to the account.
Re: Why are banks still getting authentication so wrong?
#95Can we get rid of the password expiration too? Requiring that users change their perfectly secure password every 6 months is absurd and gives the impression of security when in reality it only makes things worse.
NIST only changed that recommendation last year. Expect that update to take at least 10 years to percolate through institutions like banks.
This recommendation dates back from 2017.
> Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
8 years later, no one seems to care. Other things that the NIST doesn't recommend is rules such as "letters + numbers + special characters". What it does recommend is checking for known weak passwords, such as passwords that are present in dictionaries and leaks or relate to the user name.
Here is the relevant document: https://pages.nist.gov/800-63-3/sp800-63b.html
Re: Why are banks still getting authentication so wrong?
#96Identity providing is a natural monopoly and should be provided by the state in same manner as a passport is provided. We can discuss the implementation but in Denmark and quite a few other countries, the login problem in online government services and banking is solved by a single state run identity provider (MitID) and hopefully the EU will be succesful with their EIDAS initiative and provide a solution that works…
In the U.S., identity providing is not a role the government fills. Not everyone has to have a passport, for example. A passport is merely a purpose-specific tool for crossing borders, not general identity.
You have plenty of government id's in the US as well. Driver licenses, tax number, birth certificates ...
I think often people mess up the subjects of privacy, freedom and a government provided id. You can have privacy and freedom even if you have a government issued id. And you can have your privacy and freedom taken away from you without the government giving you standardized way of proving your id.
Re: Why are banks still getting authentication so wrong?
#97UBS Switzerland has a decent system. When I first opened the account 15 years ago we had a number pad of codes on paper we entered as the authentication. Then later we got a credit card sized electronic device where we enter a passcode and it gives us a one-time code to enter to login. And now we have an Access app - we go to the website, enter our contract number, point our phone at a QR code on the webpage and auth…
while working for UBS (outside of Switzerland) i believe I had to use the same card, but oh boy it's expensive.
Re: Why are banks still getting authentication so wrong?
#98Does password requirements with short max length count as getting it wrong? Because I see that all the time. Also a password box that will accept more characters than the max password length.
How about one that accepts any length on create but truncates it in the DB so your password manager saves the long one you typed in when it’s actually cut off at 12 chars? Had that one recently.
Re: Why are banks still getting authentication so wrong?
#99i worked on a large platform (YC company, too!) previously on their 2FA implementation. while not ideal, it was decided to keep SMS 2FA because there are still people out there without smart phones or in general the ability to do TOTP. but they still have some means to access the site that wasn't a smartphone i guess.
so, it's a bit of a compatibility issue, i guess there will be some portion of the population who will be very upset that they need to buy a whole new smartphone just to securely access their banking details
Re: Why are banks still getting authentication so wrong?
#100Why is there no standardized e-ID in the US? How much money is wasted by different authorities and businesses having to reinvent the same wheel over and over? I have used the same auth for doing my taxes or checking my prescriptions or signing into my bank for 20 years.
The current US administration is known for illegally deporting permanent residents and has stated intent to deport natural-born citizens. It should be self-evident why a centralized ID system under the control of the executive branch is a terrible idea.