Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are banks still getting authentication so wrong?

jamal.haba.sh

Post reply on HN
Print view View original

181–190 of 375 posts

Re: Why are banks still getting authentication so wrong?

#181

Post by ssl232 »

wodenokoto wrote: post #45
bryanlarsen wrote: post #4

Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.

When calling my bank I have to enter my entire CC number AND my PIN code. Talk about training people to give away sensitive data.

In Germany, paying for goods online using Sofort (direct bank payment, not buy now pay later) literally involves typing in the same credentials used to log into online banking, that’s your account number, branch and PIN, followed by scanning a “TAN” similar to a QR code using the bank app. The only thing stopping them taking my data and logging into my banking it seems is the TAN app part, that could easily be phished.

Edit: changed Klarna to Sofort

Re: Why are banks still getting authentication so wrong?

#182

Post by chvid »

kortilla wrote: post #158
chvid wrote: post #96

Earlier quoted context omitted.

You have plenty of government id's in the US as well. Driver licenses, tax number, birth certificates ... I think often people mess up the subjects of privacy, freedom and a government provided id. You can have privacy and freedom even if you have a government issued id. And you can have your privacy and freedom taken away from you without the government giving you standardized way of proving your id.

You can’t have privacy if everyone uses the government as an SSO. People might be more amenable if SSO wasn’t implemented as these stupid OIDC flows where the govt gets to know every time you login to your bank and what IP you’re using, etc.

But you can if you live in a well functioning democratic society - remember the alternative is not no id but privatized for profit identity providers like Google and Facebook.

Re: Why are banks still getting authentication so wrong?

#183

Post by TylerE »

kube-system wrote: post #130
anon7000 wrote: post #75

Earlier quoted context omitted.

I mean this is basically the ENTIRE US health system

Birthdates are frequently asked in US health settings not as a protection against attack, but as a protection against mistake . They are not worried that someone is going to come in, and steal your appointment. They are worried that someone with the same name as you might show up on the same day and the doctor might treat the wrong patient with the wrong information. This is an completely different risk profile than…

This is a realer problem than some realize.

I have the same name as my father (first and last, , different middle). We live at the same address. It’s a small town so we share a lot of the same doctors. We use the same pharmacy.

For just a bit of extra spice are birthdays are only two days apart.

Re: Why are banks still getting authentication so wrong?

#184

Post by sir_brickalot »

sedatk wrote: post #67
gtkspert wrote: post #42

You have to think of a Bank's threat model though. Account compromise is one threat, but the use of valid accounts for money laundering is another. In my view the reason they "get it wrong" is because they don't want you to be able to automate transactions, as that makes money laundering easier... Therefore, they don't want to use standard TOTP because that's easy to automate. Requiring SMS based 2FA is harder (but n…

Also, people usually underestimate the problems of TOTP. Losing TOTP is easy. Lose your phone and it's gone. It means game over for a regular person. SMS is light years ahead in terms of ease of recovery. Even after losing your phone, you can stop by a store, activate your SIM back again with your ID. Not the case with TOTP. Yes, some of the SMS recovery scenarios can make hackers hijack your account easily too, but…

Counter: Backups for TOTP are easy and you can use multiple devices/services for a single TOTP login.

Re: Why are banks still getting authentication so wrong?

#186

Post by bigfatkitten »

FireBeyond wrote: post #101
fkyoureadthedoc wrote: post #34

Earlier quoted context omitted.

Recently had to call Discover because of unauthorized use of card, apparently to buy Facebook ads of all things. They didn't call me, just locked my account and said I had to call them. I couldn't even pay the balance until I did. Anyway they needed to verify my identity, so they ask me for some info from the back of the card and a phone number that they can send the OTP to. I give them a phone number, it's not even…

Background check for a new employer resulted in me getting an email to my personal account: "Hi, I'm XYZ from XYZ background checks, I'm conducting your pre-employment check, and I just want to confirm that your full name is V, your DOB is W, your place of birth is X, your address is Y and your full SSN is Z... ... and that this is the correct email address for you. Please confirm." Holy hell. Thankfully I reached ou…

Sounds like the sort of thing Hireright would do.

Re: Why are banks still getting authentication so wrong?

#187

Post by viewtransform »

airstrike wrote: post #64
eptcyka wrote: post #32

Earlier quoted context omitted.

It's stupid to give out credentials over the phone, but it's stupider still to have a system where one's birth date is a credential that is supposed to remain confidential.

Same for SSNs

What we need instead is an orb like thing that scans your eyeballs.

Re: Why are banks still getting authentication so wrong?

#188

Post by hamburglar »

pc86 wrote: post #167
rrr_oh_man wrote: post #60

Earlier quoted context omitted.

Password manager ftw

This is fine for services you can easily access on a phone or computer. My employer requires I change my laptop password every 60 days, it stores the last 2 years of passwords to prevent reuse. I am not opening up LastPass and plugging in a 32 character random string every time I want to start my computer up. My password at any given point is either a few random words and a number, or a short (8-12 character) alphanu…

The only solution to this problem is to put your password on a post-it note in the most obvious place possible? Are we sure the CISO is the idiot in this story? This sounds like malicious negligence. I sure hope nothing that actually matters is on your system.

Re: Why are banks still getting authentication so wrong?

#189

Post by TuxPowered »

ssl232 wrote: post #181
wodenokoto wrote: post #45

Earlier quoted context omitted.

When calling my bank I have to enter my entire CC number AND my PIN code. Talk about training people to give away sensitive data.

In Germany, paying for goods online using Sofort (direct bank payment, not buy now pay later) literally involves typing in the same credentials used to log into online banking, that’s your account number, branch and PIN, followed by scanning a “TAN” similar to a QR code using the bank app. The only thing stopping them taking my data and logging into my banking it seems is the TAN app part, that could easily be phishe…

Is this another incarnation of Sofort? Fortunately nobody is forced to used the former nor the later, you can either pay with card or just make your own SEPA transfer from any bank in Europe.

Re: Why are banks still getting authentication so wrong?

#190

Post by Yizahi »

bryanlarsen wrote: post #4

Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.

I had a revelation this year, I have a new bank acc and not familiar with their procedure. First few calls they did to me, they have asked some good questions, aside from my name thy were negative - e.g. did you do X thing in your app, when we both know that I did not. But then last time an operator called and asked my PII question (birthday, address etc.). I got triggered and said "eh, sorry, won't tell you because unsafe". And she went "oh, no problem then - I will auth you in the app". Lo and behold, immediately I got push from bank app with her name, phone number calling and some details. So they do have a perfectly 1)safe, 2)repeatably reliable, 3) and fast way to authenticate customers. They just ignore it mostly. I'm still simultaneously like them and is angry on them.

tl;dr - bank calling you can do auth digitally on phone, but don't do it and don't advertise it to clients.

PS: I'm in EU.

Post reply on HN