Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are banks still getting authentication so wrong?

jamal.haba.sh

Post reply on HN
Print view View original

261–270 of 375 posts

Re: Why are banks still getting authentication so wrong?

#261

Post by lxgr »

chvid wrote: post #96
snowwrestler wrote: post #48

Earlier quoted context omitted.

In the U.S., identity providing is not a role the government fills. Not everyone has to have a passport, for example. A passport is merely a purpose-specific tool for crossing borders, not general identity.

You have plenty of government id's in the US as well. Driver licenses, tax number, birth certificates ... I think often people mess up the subjects of privacy, freedom and a government provided id. You can have privacy and freedom even if you have a government issued id. And you can have your privacy and freedom taken away from you without the government giving you standardized way of proving your id.

A tax number isn't an identity document (it's an identifier), nor is a birth certificate (since it doesn't have a photo).

Driver's licenses (or non-driver IDs) are the US's de facto ID standard.

Re: Why are banks still getting authentication so wrong?

#262

Post by aucisson_masque »

I'd be curious to know what bank does actually proper authentification ? Like 2fa with otp code or passkey.

I went through quite a few bank in my life, some old style bank, some all internet bank, they were all some shade of horrible.

Neither offered proper authentification method.

Re: Why are banks still getting authentication so wrong?

#263

Post by lxgr »

kortilla wrote: post #158
chvid wrote: post #96

Earlier quoted context omitted.

You have plenty of government id's in the US as well. Driver licenses, tax number, birth certificates ... I think often people mess up the subjects of privacy, freedom and a government provided id. You can have privacy and freedom even if you have a government issued id. And you can have your privacy and freedom taken away from you without the government giving you standardized way of proving your id.

You can’t have privacy if everyone uses the government as an SSO. People might be more amenable if SSO wasn’t implemented as these stupid OIDC flows where the govt gets to know every time you login to your bank and what IP you’re using, etc.

> You can’t have privacy if everyone uses the government as an SSO.

Why not? Anonymous cryptographic attestation methods (e.g. of only the fact that you are over 18 years old, that you are a permanent resident etc.) exist.

Re: Why are banks still getting authentication so wrong?

#264

Post by lxgr »

kortilla wrote: post #154
loeg wrote: post #120

Earlier quoted context omitted.

And it is a significant flaw of the US model!

Not if you ask people who specifically don’t want the government tracking everything

Ironically, lax to nonexistent data privacy laws and the ubiquitous use of SSNs as globally unique identifiers are achieving exactly the outcome that the lack of government ID verification purportedly achieves.

Re: Why are banks still getting authentication so wrong?

#265

Post by lxgr »

riffraff wrote: post #55
chvid wrote: post #29

Identity providing is a natural monopoly and should be provided by the state in same manner as a passport is provided. We can discuss the implementation but in Denmark and quite a few other countries, the login problem in online government services and banking is solved by a single state run identity provider (MitID) and hopefully the EU will be succesful with their EIDAS initiative and provide a solution that works…

italy has quite an interesting system[0] where multiple identity providers (authorized by the State) can be used to provide identification against the central database. It'll probably be phased out at some point, but it's quite cool. [0] https://www.spid.gov.it/en/citizens/ it integrates with eIDAS too

If it integrates with eIDAS, it doesn't necessarily have to be phased out. A very good pragmatic decision of eIDAS was recognizing that many member countries have different existing eID schemes, and federating them is easier than rolling out a new one from scratch.

Re: Why are banks still getting authentication so wrong?

#266

Post by lxgr »

sneak wrote: post #76
chvid wrote: post #29

Identity providing is a natural monopoly and should be provided by the state in same manner as a passport is provided. We can discuss the implementation but in Denmark and quite a few other countries, the login problem in online government services and banking is solved by a single state run identity provider (MitID) and hopefully the EU will be succesful with their EIDAS initiative and provide a solution that works…

Absolutely not! The moment you have universal state-issued identity, you will be expected to provide it for everything , including tons of stuff that doesn’t require identity. Don’t be a privacy defeatist, the fight isn’t lost yet. Resist every single effort to make it easier for merchants and private entities to strongly identify users. The rows go into databases and they never go away. State-issued identity is one…

I've lived both in countries that have state-issued IDs and in the US, and I don't have much doubt about where I've felt better protected in terms of data privacy...

Re: Why are banks still getting authentication so wrong?

#267

Post by progmetaldev »

I work on the CMS side of banking, where promotions and current rates are posted regularly. All actual banking is done through a first-party link to external systems. The amount of scrutiny and regular application scanning for vulnerabilities that is done on the CMS software I've built drives me insane, considering the glaring holes in security that affect their systems that actually deal with money. I take security seriously, and it's one of the main selling points of the software I build, but knowing how poorly made these systems are that house what a malicious user actually wants makes me understand how much of society's systems play security theater.

Re: Why are banks still getting authentication so wrong?

#268

Post by kdbg »

Only tangentially related but I'm a Canadian but have been on a US Cell provider (AT&T) for over a decade now because its cheaper, especially when I used to spend a lot more time roaming in the US. The number of Canadian companies that fail silently when sending SMS to US numbers is too damn high.

My bank is one of those with Verified by Visa. Thankfully I've figured out that using the Voice option instead of Text will work but still that silent failure is really annoying.

Re: Why are banks still getting authentication so wrong?

#269

Post by lxgr »

buckle8017 wrote: post #255
h4ckerle wrote: post #253

As a european I again find it crazy what kinds of insecure stuff the banking industry in the US does. Chip+PIN arrived long after they did here, SMS Tan is still a thing while EU Payment Services Directive 2 (PSD2) forbid this in 2018, 7 years ago. Many transactions are still authenticated via signatures on paper cheques, you can use your credit card without a second factor (also regulated by PSD2). I just can't unde…

> I'd assume fixing this would cost less than what fraud must be costing them today. You'd be wrong there but not for obvious reasons. Ultimately the cost of fraud is passed on to consumers. Banks pass the costs on to merchants, who in turn increase prices. As a merchant increasing friction in the checkout process to reduce fraud does not improve profitability (broadly speaking). So no they had no actual financial in…

In the case of credit card payments this is true, but for checks and other P2P payments, there is no merchant to pass on costs to.

For these, it's usually the banks absorbing the losses themselves (or their customers, if they aren't legally required to, but in many cases they are).

Re: Why are banks still getting authentication so wrong?

#270

Post by Muromec »

nmca wrote: post #244
Muromec wrote: post #82

Earlier quoted context omitted.

If only there was some kind of a physical tokem with a crypto key that is protected by a password and tied to one's bank account. -s

I know this was sarcasm, but bank card is not appropriate because you should have one hardware key for all services produced by an independent provider.

Why would I want to have one key for all them? To lose access or get them all compromised at the same time?
Post reply on HN