Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are banks still getting authentication so wrong?

jamal.haba.sh

Post reply on HN
Print view View original

131–140 of 375 posts

Re: Why are banks still getting authentication so wrong?

#131

Post by 878654Tom »

Phui3ferubus wrote: post #21

> TOTP Support: Let users use any standard authenticator How many of them allow to generate a code related to specific operation (provide a context for what is being "confirmed")? This is the EU requirement that killed everything but SMS and bank mobile apps.

And I love that requirement. I do banking on my desktop and to confirm the transfers I get a push notification from a third-party application (ItsMe, so not a banking mobile app) with all the information I have entered.

I can confirm the transaction from a complete separate device while doing a second check if all details are correct.

Re: Why are banks still getting authentication so wrong?

#132

Post by sedatk »

loeg wrote: post #119
sedatk wrote: post #88

Earlier quoted context omitted.

What do you think such a recovery mechanism would look like without SMS?

Show up in person with ID.

Yes, but remember, the original scenario was person leaving Canada, and trying to use their Canadian bank account from the US. There is nowhere to show up. But, if they could swallow SMS roaming costs temporarily, they could access to their account easily.

Re: Why are banks still getting authentication so wrong?

#135

Post by sedatk »

Detrytus wrote: post #105
sedatk wrote: post #88

Earlier quoted context omitted.

What do you think such a recovery mechanism would look like without SMS?

Password managers, such as KeePassX can generate TOTP codes. And Keepass database is just a file, you can have as many backups of it as you want.

You overestimate a regular person's technical skills and their capability of planning resilient backup strategies.

Re: Why are banks still getting authentication so wrong?

#136

Post by samwise_i »

cypherpunks01 wrote: post #133

Any US banks support TOTP or Yubikey/U2F requirements for login yet? I've seen a couple consumer fintech products that support TOTP, still not many, and no banks I'm aware of.

Wells Fargo offers RSA hardware tokens if you know how to ask for them:-) Schwab offers a Symantec hardware token Vangaurd allows the use of a FIDO device (YubiKey)

Re: Why are banks still getting authentication so wrong?

#137

Post by Uvix »

sedatk wrote: post #122
Uvix wrote: post #94

Earlier quoted context omitted.

Syncing the TOTP credentials from a cloud account of some sort (iCloud/Google for the masses, Bitwarden or another password manager for more technical users) to the device. As a fallback recovery mechanism, offline backup codes generated at the time the TOTP is applied to the account.

Then you make Google/iCloud the point of entry to someone's bank account. That completely changes the threat model for customers, and possibly for worse than SMS. Offline backup codes, when printed, isn't such a bad idea. But when you lose that piece of paper, again, game over. SMS is fantastically resilient to these scenarios. There's a reason banks insist on using it.

SMS isn't resilient to the worker at the local retail store for the phone carrier giving someone else a SIM for my phone number. That's a much bigger threat vector than Google/iCloud/a sync target I manage storing an encrypted version of the TOTP credentials.

Re: Why are banks still getting authentication so wrong?

#138

Post by noleary »

> I don’t think anyone considers a bank account “low-risk.” Yet here we are, still relying on SMS as the default, and sometimes only, 2FA option

> Passkeys (FIDO2/WebAuthn): Phishing-resistant, device-based login using biometrics. Excellent UX and security.

In response to the complaints about SMS MFA, yeah, it has its issues (we don't even support it in our auth software) but it's not totally indefensible. It makes it much, much easier to push MFA.

When I talk to end users about auth flows, they almost invariably complain about MFA. People hate MFA. They will avoid it if they can. With that in mind, while SMS 2FA has problems, we should recognize that it's minimally disruptive to users. It's familiar. People understand how it works. In this sense, it has major advantages over alternatives.

People really don't understand passkeys. I even meet professional software developers fairly often who -- at least to their knowledge -- have never used passkeys. It will take a very long time before this is well-understood by the average consumer.

Lots of people complain about TOTPs too. Downloading authenticator apps sucks and is confusing to many people. Even sending codes to people's email addresses causes problems; many people have several email addresses for which they forget passwords routinely. By contrast, mostly everyone has no problem opening a text message on their phone (which is pretty much always within reach).

We can't design software for the way we hope users will behave (e.g., telling people just use a password manager). Especially if you're making mass market consumer software, you really have to meet people where they are.

Re: Why are banks still getting authentication so wrong?

#139

Post by howard941 »

ted_dunning wrote: post #124
howard941 wrote: post #106

Earlier quoted context omitted.

Social Security just tried to authenticate my wife's birthday this way. She told them no, give me your phone #. It googled to SSA in Alabama and she called it up and proceeded from there.

Googling a scammers phone number often lands you on a site that looks just like the real thing. You should have looked up the ssa site and found the number that way.

Good point

Re: Why are banks still getting authentication so wrong?

#140

Post by FateOfNations »

craftkiller wrote: post #89
Muromec wrote: post #82

Earlier quoted context omitted.

If only there was some kind of a physical tokem with a crypto key that is protected by a password and tied to one's bank account. -s

The only bit we're lacking is the "tied to one's bank account". The rest already exists in the form of yubikeys and other hardware security tokens.

Your bank/credit/debit/etc. card is a “physical token with a crypto key that is protected by a password and tied to one's bank account”. FIDO and EMV even both use the same underlying ISO/IEC 7816 and 14443 protocols for communications.
Post reply on HN