Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are banks still getting authentication so wrong?

jamal.haba.sh

Post reply on HN
Print view View original

121–130 of 375 posts

Re: Why are banks still getting authentication so wrong?

#121

Post by FireBeyond »

pwg wrote: post #80
martinald wrote: post #51

The reason it's a farce is because most banks are using some off the shelf system from one of the big vendors in the space OR legacy systems, or both. FIS is a good example. They have basically no real motive to improve anything (the lock in is utterly extreme) and no doubt will charge through the eyeballs for any improvements - especially ones that are regulatory related. You can see the difference between a legacy…

> using some off the shelf system from one of the big vendors This also gives the bank 'cover' should an exploit be uncovered in "big vendors" system. They (the bank) are safe liability wise (or at least they think they are) because they used "approved vendor Y" for their authentication system. If they created their own system, then they would be unable to offload the liability onto someone else.

> If they created their own system, then they would be unable to offload the liability onto someone else.

In a sense. The big banks in the US created Zelle with one of the specific outcomes being to offload liability for unauthorized transactions more on to the consumer than themselves.

Re: Why are banks still getting authentication so wrong?

#122

Post by sedatk »

Uvix wrote: post #94
sedatk wrote: post #88

Earlier quoted context omitted.

What do you think such a recovery mechanism would look like without SMS?

Syncing the TOTP credentials from a cloud account of some sort (iCloud/Google for the masses, Bitwarden or another password manager for more technical users) to the device. As a fallback recovery mechanism, offline backup codes generated at the time the TOTP is applied to the account.

Then you make Google/iCloud the point of entry to someone's bank account. That completely changes the threat model for customers, and possibly for worse than SMS.

Offline backup codes, when printed, isn't such a bad idea. But when you lose that piece of paper, again, game over.

SMS is fantastically resilient to these scenarios. There's a reason banks insist on using it.

Re: Why are banks still getting authentication so wrong?

#123

Post by LtWorf »

anon7000 wrote: post #75
eptcyka wrote: post #32

Earlier quoted context omitted.

It's stupid to give out credentials over the phone, but it's stupider still to have a system where one's birth date is a credential that is supposed to remain confidential.

I mean this is basically the ENTIRE US health system

Healthcare in USA is famous for many things, but making sense is not one of them.

Re: Why are banks still getting authentication so wrong?

#124

Post by ted_dunning »

howard941 wrote: post #106
bryanlarsen wrote: post #4

Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.

Social Security just tried to authenticate my wife's birthday this way. She told them no, give me your phone #. It googled to SSA in Alabama and she called it up and proceeded from there.

Googling a scammers phone number often lands you on a site that looks just like the real thing.

You should have looked up the ssa site and found the number that way.

Re: Why are banks still getting authentication so wrong?

#125

Post by blitzar »

bryanlarsen wrote: post #4

Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.

> they still expect you to authenticate when they phone you

Why has some startup not solved this problem already?

Re: Why are banks still getting authentication so wrong?

#126

Post by jszymborski »

charcircuit wrote: post #77
gtkspert wrote: post #42

You have to think of a Bank's threat model though. Account compromise is one threat, but the use of valid accounts for money laundering is another. In my view the reason they "get it wrong" is because they don't want you to be able to automate transactions, as that makes money laundering easier... Therefore, they don't want to use standard TOTP because that's easy to automate. Requiring SMS based 2FA is harder (but n…

Why would a bank care about money laundering?

HSBC determined its retail banking operations in NA were not worth it any longer due to the liability they faced after their high-profile money laundering scandal [0].

[0] https://www.investopedia.com/stock-analysis/2013/investing-n...

Re: Why are banks still getting authentication so wrong?

#127

Post by punnerud »

We had SMS-auth in Norway until 15 years ago (?), then it was a special type of SMS popping all over your screen that was more secure. Now all that is gone and replaced with Apps for auth, with scanning of your Passport/NationalID using NFC + SMS the first time.

Re: Why are banks still getting authentication so wrong?

#128

Post by pasttense01 »

Muromec wrote: post #82
nmca wrote: post #43

Earlier quoted context omitted.

hardware tokens are the way! Everyone has had a house key their whole lives, and understands how to keep a spare to prevent lock-outs.

If only there was some kind of a physical tokem with a crypto key that is protected by a password and tied to one's bank account. -s

Some of us don't want to have a dozen plus separate physical tokens (one for each of bank/credit card/tax, etc sites with sensitive financial information we have).

Re: Why are banks still getting authentication so wrong?

#129

Post by josephthejoe »

charcircuit wrote: post #77
gtkspert wrote: post #42

You have to think of a Bank's threat model though. Account compromise is one threat, but the use of valid accounts for money laundering is another. In my view the reason they "get it wrong" is because they don't want you to be able to automate transactions, as that makes money laundering easier... Therefore, they don't want to use standard TOTP because that's easy to automate. Requiring SMS based 2FA is harder (but n…

Why would a bank care about money laundering?

It's a long-complicated story but it essentially boils down to this: https://en.wikipedia.org/wiki/Bank_Secrecy_Act

Re: Why are banks still getting authentication so wrong?

#130

Post by kube-system »

anon7000 wrote: post #75
eptcyka wrote: post #32

Earlier quoted context omitted.

It's stupid to give out credentials over the phone, but it's stupider still to have a system where one's birth date is a credential that is supposed to remain confidential.

I mean this is basically the ENTIRE US health system

Birthdates are frequently asked in US health settings not as a protection against attack, but as a protection against mistake.

They are not worried that someone is going to come in, and steal your appointment. They are worried that someone with the same name as you might show up on the same day and the doctor might treat the wrong patient with the wrong information.

This is an completely different risk profile than a form on the internet.

Post reply on HN