Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are banks still getting authentication so wrong?

jamal.haba.sh

Post reply on HN
Print view View original

111–120 of 375 posts

Re: Why are banks still getting authentication so wrong?

#111

Post by hosteur »

sneak wrote: post #76
chvid wrote: post #29

Identity providing is a natural monopoly and should be provided by the state in same manner as a passport is provided. We can discuss the implementation but in Denmark and quite a few other countries, the login problem in online government services and banking is solved by a single state run identity provider (MitID) and hopefully the EU will be succesful with their EIDAS initiative and provide a solution that works…

Absolutely not! The moment you have universal state-issued identity, you will be expected to provide it for everything , including tons of stuff that doesn’t require identity. Don’t be a privacy defeatist, the fight isn’t lost yet. Resist every single effort to make it easier for merchants and private entities to strongly identify users. The rows go into databases and they never go away. State-issued identity is one…

> Absolutely not! The moment you have universal state-issued identity, you will be expected to provide it for everything, including tons of stuff that doesn’t require identity.

Indeed this has happened in Denmark already where for example DBA (Danish version of ebay) started soft-mandating MitID verification. Soon to be actually mandatory.

Re: Why are banks still getting authentication so wrong?

#112

Post by bluGill »

newhotelowner wrote: post #54
kokonoko wrote: post #16

Can we get rid of the password expiration too? Requiring that users change their perfectly secure password every 6 months is absurd and gives the impression of security when in reality it only makes things worse.

Our hotel franchise requires us to change the password every month. We can't use the last 6-8 passwords.

Password1, Password2 ... Password123456789 - I can do this all day. And realy you should as a password you can easially remember is a bad password so the first part that doesn't change is the important part

Re: Why are banks still getting authentication so wrong?

#113

Post by Dylan16807 »

stef25 wrote: post #103
sneak wrote: post #76

Earlier quoted context omitted.

Absolutely not! The moment you have universal state-issued identity, you will be expected to provide it for everything , including tons of stuff that doesn’t require identity. Don’t be a privacy defeatist, the fight isn’t lost yet. Resist every single effort to make it easier for merchants and private entities to strongly identify users. The rows go into databases and they never go away. State-issued identity is one…

We have universal ID cards here in Belgium. They have a chip and along with a special card reader usb device you can log in to govt websites related to taxes, pension and basically everything else. If you have a smartphone you can use an app to scan a QR and log in that way. It's super convenient. Where is the privacy problem if you use this system to consult your own civil data ? Privacy is a thing in the EU and it'…

If it's easy enough to connect such an ID with arbitrary companies, I don't trust US privacy laws to prevent them from requiring it.

Re: Why are banks still getting authentication so wrong?

#114

Post by alkonaut »

throwaway562if1 wrote: post #100
alkonaut wrote: post #72

Why is there no standardized e-ID in the US? How much money is wasted by different authorities and businesses having to reinvent the same wheel over and over? I have used the same auth for doing my taxes or checking my prescriptions or signing into my bank for 20 years.

The current US administration is known for illegally deporting permanent residents and has stated intent to deport natural-born citizens. It should be self-evident why a centralized ID system under the control of the executive branch is a terrible idea.

That's horrible but why would it be worse together with an e-id system?

Re: Why are banks still getting authentication so wrong?

#115

Post by bluGill »

shadowgovt wrote: post #62

Broadly speaking: because they don't have to get it right. Banks are generally protected from fraud not by up-front security, but by auditing. If someone mis-applies funds, they have a chain of transactions they can back out. And, if someone does it maliciously, they have a disproportionate support of the force of law to discourage such behavior. Contrast most software companies, where theft of data is not a reversib…

While not wrong it will big a big hasstle for whoever is the fraud victum while things are reversed. You may even lose other things in your life because you are unable to pay bills you technically have the money for but cannot access the money.

Re: Why are banks still getting authentication so wrong?

#116

Post by tgsovlerkhgsel »

None of the recommended alternatives show what you are authenticating for.

The proprietary auth solution as well as SMS will show "To authorize a transaction of $12,345.67 to account ..., enter code 123456". SMS isn't secure because there are various ways for the attacker to get the code aside from phishing.

The apps are a royal pain for the user, but they enable this flow, and they are secure for the bank.

The bank has limited incentive to make the user happy, but a lot of incentive to a) minimize fraud, b) be able to blame the user for the remaining fraud.

That's why you will keep getting shitty, user-hostile authentication apps, and that's why banks will keep losing some (but probably not enough to make them care) customers to neobanks that are prioritizing user experience. And why neobanks will enshittify once they are no longer willing to buy adoption by accepting more fraud.

Re: Why are banks still getting authentication so wrong?

#118

Post by Hackbraten »

bouncing wrote: post #56

The problem with the suggestions here is that it puts all your eggs in the same basket. 1Password TOTP? If both your password and the TOTP are in your password manager, you arguably really just have a single factor, delegated to a third party (your password manager). PassKeys? Same problem. Storing your recovery keys in your password manager? You again just have 1 factor. SMS is bad and should go away, but it isn't s…

If you use a password manager, you might not be part of the target group that benefits most from a second factor.

A decent password manager nudges you into using unique passwords per service. Good password managers also offer you a browser extension, which injects the password directly into the DOM instead of using the clipboard, and checks the domain, too. It's not 100% secure, but at that point, 2FA may be a diminishing return already.

Re: Why are banks still getting authentication so wrong?

#119

Post by loeg »

sedatk wrote: post #88
sneak wrote: post #71

Earlier quoted context omitted.

Precisely nobody is suggesting that there be no recovery mechanism. This criticism is a red herring.

What do you think such a recovery mechanism would look like without SMS?

Show up in person with ID.

Re: Why are banks still getting authentication so wrong?

#120

Post by loeg »

snowwrestler wrote: post #48
chvid wrote: post #29

Identity providing is a natural monopoly and should be provided by the state in same manner as a passport is provided. We can discuss the implementation but in Denmark and quite a few other countries, the login problem in online government services and banking is solved by a single state run identity provider (MitID) and hopefully the EU will be succesful with their EIDAS initiative and provide a solution that works…

In the U.S., identity providing is not a role the government fills. Not everyone has to have a passport, for example. A passport is merely a purpose-specific tool for crossing borders, not general identity.

And it is a significant flaw of the US model!
Post reply on HN