Why are banks still getting authentication so wrong? • Hacker News Board

Re: Why are banks still getting authentication so wrong?

#241

Post by Zak » Tue, May 13, 2025, 10:19 PM UTC

idontcareatall wrote: post #174

noleary wrote: post #138

> I don’t think anyone considers a bank account “low-risk.” Yet here we are, still relying on SMS as the default, and sometimes only, 2FA option > Passkeys (FIDO2/WebAuthn): Phishing-resistant, device-based login using biometrics. Excellent UX and security. In response to the complaints about SMS MFA, yeah, it has its issues (we don't even support it in our auth software) but it's not totally indefensible. It makes i…

I. don't. care. Because we have to cater to the absolute lowest denominator, I now can't use my credit card 90% of the time because I can't receive SMS when I'm traveling aboard? No, not everyone has a fking iPhone and iMessage. Nothing in your comment serves as a defense of most places only having SMS 2FA. Why can Capital One email me every critical account notification, but can't email me 2FA/OTP codes for confirmi…

> No, not everyone has a fking iPhone and iMessage.

I don't think iMessage solves the problem of receiving an SMS from your bank where your SIM card is inactive or disabled due to roaming costs.

A VOIP number like Google Voice can solve that problem, but some services that do SMS-based verification reject phone numbers that a database says are VOIP.

Re: Why are banks still getting authentication so wrong?

#242

Post by kbolino » Tue, May 13, 2025, 10:21 PM UTC

Uvix wrote: post #137

sedatk wrote: post #122

Earlier quoted context omitted.

Then you make Google/iCloud the point of entry to someone's bank account. That completely changes the threat model for customers, and possibly for worse than SMS. Offline backup codes, when printed, isn't such a bad idea. But when you lose that piece of paper, again, game over. SMS is fantastically resilient to these scenarios. There's a reason banks insist on using it.

SMS isn't resilient to the worker at the local retail store for the phone carrier giving someone else a SIM for my phone number. That's a much bigger threat vector than Google/iCloud/a sync target I manage storing an encrypted version of the TOTP credentials.

How realistic is this threat? I would think that the employees would have to jump through hoops that require you to be present (or at least a lot more of your info to be stolen than just your name and number) and that the home network would detect a duplicate E.164 number with conflicting IMEI/IMSI numbers and locations pretty quickly.

Re: Why are banks still getting authentication so wrong?

#243

Post by frenchtoast8 » Tue, May 13, 2025, 10:23 PM UTC

There are a lot of people who get confused using the SMS code they received, let alone setting up passkeys, or TOTP and backing up their codes, and so on. The systems are designed for those people, not you. Even offering passkeys or TOTP as an option is a customer support liability, that's another thing agents need to support when someone nontechnical inevitably enabled this on accident or has a family member set it up for them.

> Think of the person from your grade school classes who had the most difficulty at everything. The U.S. expects banks to service people much, much less intelligent than them. Some customers do not understand why a $45 charge and a $32 charge would overdraw an account with $70 in it. [...] This customer calls the bank much more frequently than you do.

https://www.bitsaboutmoney.com/archive/seeing-like-a-bank/

Re: Why are banks still getting authentication so wrong?

#244

Post by nmca » Tue, May 13, 2025, 10:24 PM UTC

Muromec wrote: post #82

nmca wrote: post #43

Earlier quoted context omitted.

hardware tokens are the way! Everyone has had a house key their whole lives, and understands how to keep a spare to prevent lock-outs.

If only there was some kind of a physical tokem with a crypto key that is protected by a password and tied to one's bank account. -s

I know this was sarcasm, but bank card is not appropriate because you should have one hardware key for all services produced by an independent provider.

Re: Why are banks still getting authentication so wrong?

#245

Post by [deleted] » Tue, May 13, 2025, 10:30 PM UTC

al_borland wrote: post #234

bee_rider wrote: post #36

Earlier quoted context omitted.

My rule is simple: if you contact me, you are the one that had to authenticate. Otherwise you are probably a scammer. Although, I haven’t had many instances of communications from my bank where I cared about them authenticating. Like, if they tell me there is a problem, I can go check it out through the app, website, or whatever the user-initiated channel is. When I feel like it.

I don’t have a good way to authenticate someone is calling from the bank on my end. I ask what the basic issue is, then call the general bank number (or a number to their department, which I validate online before calling it). That way I’m initiating the call to a trusted number, and they can go through their process to authenticate me. Every time I’ve done this the person calling has understood and seemed to appreci…

[deleted]

Re: Why are banks still getting authentication so wrong?

#246

Post by deathanatos » Tue, May 13, 2025, 10:32 PM UTC

Brybry wrote: post #110

Muromec wrote: post #66

Earlier quoted context omitted.

Federal government or governmemts in general? As far as I get, driver licenses are doing in US what id cards are doing in Europe and are issued by governments too.

While a driver's license does normally fill that role, it's not mandated and not everyone has a driver's license (or even a state issued ID). Some stuff like voting you can use something like a utility bill. Some stuff will want your birth certificate. Some stuff will want multiple types of documents. Americans have historically been against mandated government IDs (though mostly with the concept of a federal/nationa…

This whole thread is going to motte & bailey between the various forms of US gov ID. Between the union of {SSN, birth cert, driver's license (or ID in lieu thereof)}, it seems to be there's the equivalent of a federal ID. Just, like everything else we do, a terrible incomprehensible mess to Europeans.

My employer requires an SSN when I start a job. TSA keeps alleging they're going to require Real ID any day now. Voting, if I have my jurisdiction's requirements right, requires an SSN, though most people will experience that in the form of driver's license, since getting a license is usually automatic voter registration where I've lived.

Re: Why are banks still getting authentication so wrong?

#247

Post by crazygringo » Tue, May 13, 2025, 10:33 PM UTC

bee_rider wrote: post #36

bryanlarsen wrote: post #4

Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.

My rule is simple: if you contact me, you are the one that had to authenticate. Otherwise you are probably a scammer. Although, I haven’t had many instances of communications from my bank where I cared about them authenticating. Like, if they tell me there is a problem, I can go check it out through the app, website, or whatever the user-initiated channel is. When I feel like it.

How do you authenticate them?

I've never heard of this, I'm very curious.

Re: Why are banks still getting authentication so wrong?

#248

Post by 1a527dd5 » Tue, May 13, 2025, 10:35 PM UTC

The answer is lack of competition.

Here in the UK, all bank apps were dismal. Until Monzo and Starling arrived on the scene, and holy hell did the big 4 get their acts together.

Re: Why are banks still getting authentication so wrong?

#249

Post by crazygringo » Tue, May 13, 2025, 10:37 PM UTC

wodenokoto wrote: post #45

bryanlarsen wrote: post #4

Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.

When calling my bank I have to enter my entire CC number AND my PIN code. Talk about training people to give away sensitive data.

What is the issue? That's literally just your account number and the password.

That's what you're supposed to do. That's what security is. That's the sensitive data that ensures it's not a rando calling who stole your card.

I'm not sure what alternative you are looking for? You're the one calling them, so it's fine.

Re: Why are banks still getting authentication so wrong?

#250

Post by 000ooo000 » Tue, May 13, 2025, 10:38 PM UTC

abanana wrote: post #203

etskinner wrote: post #168

As far as I can tell, the reason why any given login is needlessly complex is that some product manager somewhere has outdated info in their head that says stuff like "passwords need 4 different character classes" and "everybody uses SMS for 2FA, we need to use that". Powerless devs then mindlessly implement what they're asked to implement.

Powerless, that's exactly it. I pushed back when asked to implement email-based "2FA" on a website account (nothing like as important as a bank though). I pointed out that the username is the email address, and password recovery works by emailing a reset link, therefore emailing a login code wouldn't be two-factor, it would be the same factor . Of course the response was: doesn't matter, the client's asked for it. I…

Are you me? I am an SE in a bank and I had this exact experience this week - though it relates to authing with the online banking system.

As I see it, it's an unfortunate combination of an extremely risk-averse environment, a total lack of trust in their IT staff, and - if I can be pointed - unqualified product teams. I can explain the the inadvertent drop from 2FA to 1FA, I can back it up with NIST, OWASP and Gov references explaining why it's a bad idea, but I am simply ignored because they are bent on execution of their 'vision'. At this point, I raise my concerns just to have my biases confirmed.

It's really frustrating and obviously as a banking customer I want sensible security features too, but if I can generalise, we devs are not driving the bus. We're stuffed in the luggage compartment, wheeled out as necessary.