Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are banks still getting authentication so wrong?

jamal.haba.sh

Post reply on HN
Print view View original

201–210 of 375 posts

Re: Why are banks still getting authentication so wrong?

#201

Post by ssl232 »

TuxPowered wrote: post #189
ssl232 wrote: post #181

Earlier quoted context omitted.

In Germany, paying for goods online using Sofort (direct bank payment, not buy now pay later) literally involves typing in the same credentials used to log into online banking, that’s your account number, branch and PIN, followed by scanning a “TAN” similar to a QR code using the bank app. The only thing stopping them taking my data and logging into my banking it seems is the TAN app part, that could easily be phishe…

Is this another incarnation of Sofort? Fortunately nobody is forced to used the former nor the later, you can either pay with card or just make your own SEPA transfer from any bank in Europe.

Ah yes it was Sofort, not Klarna.

Re: Why are banks still getting authentication so wrong?

#202

Post by fn-mote »

wodenokoto wrote: post #45
bryanlarsen wrote: post #4

Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.

When calling my bank I have to enter my entire CC number AND my PIN code. Talk about training people to give away sensitive data.

> When calling my bank I have to enter my entire CC number AND my PIN code.

YOU calling THEM is not an issue. That's the secure connection. There's not (afaik) a way to hijack the receiving phone number.

The issue is when somebody calls YOU. Faking the originating number of a phone call is easy, happens all of the time. That's the scammer route.

Re: Why are banks still getting authentication so wrong?

#203

Post by abanana »

etskinner wrote: post #168

As far as I can tell, the reason why any given login is needlessly complex is that some product manager somewhere has outdated info in their head that says stuff like "passwords need 4 different character classes" and "everybody uses SMS for 2FA, we need to use that". Powerless devs then mindlessly implement what they're asked to implement.

Powerless, that's exactly it. I pushed back when asked to implement email-based "2FA" on a website account (nothing like as important as a bank though). I pointed out that the username is the email address, and password recovery works by emailing a reset link, therefore emailing a login code wouldn't be two-factor, it would be the same factor. Of course the response was: doesn't matter, the client's asked for it. I didn't have the authority to push back any more, but luckily in this case it was just a simple website login that had no real need for 2FA anyway.

Re: Why are banks still getting authentication so wrong?

#204

Post by Muromec »

Workaccount2 wrote: post #92
Muromec wrote: post #66

Earlier quoted context omitted.

Federal government or governmemts in general? As far as I get, driver licenses are doing in US what id cards are doing in Europe and are issued by governments too.

In the US you don't need to have any form of ID. Your life will be very difficult, but you don't legally need it. ID is an optional service here.

Well, what I was replying to is about who is providing the service. Whether or not the service is mandatory is a different one. I know places on the European continent where having id and registered address is mandatory, but the fine for noncomplience is about 1 EUR.

Re: Why are banks still getting authentication so wrong?

#205

Post by kube-system »

loeg wrote: post #119
sedatk wrote: post #88

Earlier quoted context omitted.

What do you think such a recovery mechanism would look like without SMS?

Show up in person with ID.

That's not necessarily possible. Many banks do not have physical locations, and many people do banking business while physically away from a bank.

https://en.wikipedia.org/wiki/Direct_bank

Re: Why are banks still getting authentication so wrong?

#206

Post by tart-lemonade »

kortilla wrote: post #154
loeg wrote: post #120

Earlier quoted context omitted.

And it is a significant flaw of the US model!

Not if you ask people who specifically don’t want the government tracking everything

And the worst part is a federal ID would not enable tracking any more than your employers withholding wages for tax purposes and paying into Social Security does, but every time a federal ID has been proposed (which would be really useful as a way to keep SSNs from becoming something you have to disclose to everyone and their dog) it's been shut down by the "it's all a road to tyranny" crowd.

I could get a Real ID that reads "1060 W Addison St" today. All I have to do is pirate Acrobat, change the addresses on PDFs downloaded from the websites of my bank and power company, and walk into an Illinois Secretary of State office, as that's enough for the residency portion of a Real ID. They do not double-check any of this information, and I know this works because I had to edit a power bill PDF so my SO would have a second document for proof of residency. All it would take is one phone call to find out I'm the only one listed on the account, but it was never verified.

Why anyone thinks a federal ID would enable mass surveillance and tracking is beyond me. The NSA doesn't need a unified federal ID to track us, and law enforcement isn't exactly foiled by people who hold fake IDs or who have no IDs whatsoever (unless being undocumented or Amish is some magical "get out of jail free" card).

Re: Why are banks still getting authentication so wrong?

#207

Post by fn-mote »

warrenski wrote: post #193

Here in South Africa all the banks I know of moved away from SMS text messages for 2FA ages ago, and perform authentication in-app with biometrics instead. Having a banking app installed on your phone is pretty much mandatory, and criminals have no doubt grown wise to this fact. So what happens when someone holds a gun to your head and forces you to perform a large transfer of funds from your phone? I'm sure the bank…

> I'd much rather delete the apps, unlink my devices from my account and use a TOTP authenticator app instead.

I'm not clear how this changes the gun to your head scenario.

I would want to see numbers before making policy changes based on potential armed robbery.

Re: Why are banks still getting authentication so wrong?

#208

Post by Muromec »

chvid wrote: post #182
kortilla wrote: post #158

Earlier quoted context omitted.

You can’t have privacy if everyone uses the government as an SSO. People might be more amenable if SSO wasn’t implemented as these stupid OIDC flows where the govt gets to know every time you login to your bank and what IP you’re using, etc.

But you can if you live in a well functioning democratic society - remember the alternative is not no id but privatized for profit identity providers like Google and Facebook.

Well functioning democratic society is and idea that US explicitly rejects, because democratic society can point a finger at you and that doesn't feel nice.

Re: Why are banks still getting authentication so wrong?

#209

Post by mixmastamyk »

patja wrote: post #175
sneak wrote: post #76

Earlier quoted context omitted.

Absolutely not! The moment you have universal state-issued identity, you will be expected to provide it for everything , including tons of stuff that doesn’t require identity. Don’t be a privacy defeatist, the fight isn’t lost yet. Resist every single effort to make it easier for merchants and private entities to strongly identify users. The rows go into databases and they never go away. State-issued identity is one…

I'm so sick of retail clerks who insist on scanning the barcode of my driver's license. To verify I am 21 you don't need my height, weight, eye color, and home address. You can ascertain that my visually inspecting just the first two digits of my birth year.

Sounds like you may be aware, but no one should allow that to happen. When showing ID in retail situations I don't allow it to be removed from my hand.

Re: Why are banks still getting authentication so wrong?

#210

Post by agentultra »

Still not sure about Passkeys. Or biometrics. But agree that their SMS based systems are way outdated. Which is odd because, at least at the Canadian banks, the mobile and web experiences are generally pretty modern and good.

It’s almost like the various departments and make these systems don’t talk to each other.

Post reply on HN