Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are banks still getting authentication so wrong?

jamal.haba.sh

Post reply on HN
Print view View original

191–200 of 375 posts

Re: Why are banks still getting authentication so wrong?

#191

Post by dmoy »

speckx wrote: post #163
gtkspert wrote: post #42

You have to think of a Bank's threat model though. Account compromise is one threat, but the use of valid accounts for money laundering is another. In my view the reason they "get it wrong" is because they don't want you to be able to automate transactions, as that makes money laundering easier... Therefore, they don't want to use standard TOTP because that's easy to automate. Requiring SMS based 2FA is harder (but n…

I was surprised that Bank of America still does SMS based 2FA.

BoA is one of the very few US banks that do any modern auth - they support fido2 security keys.

Of course effectively 0% of their customers actually use it, and instead rely on sms

Re: Why are banks still getting authentication so wrong?

#192

Post by cccs-kevin2 »

This happened to me when I was overseas recently. No phone, I needed to access my credit card website with Scotiabank. I had previously relied on having an option for the OTP to be delivered either by email or sms, but when I tried in March, Scotiabank had removed the email option! I ended up having to basically remove 2FA from my bank account as a workaround, after answering a ton of security questions.

Therefore for the entire time I was overseas after having done this, my bank account had no 2FA enabled... smh

Re: Why are banks still getting authentication so wrong?

#193

Post by warrenski »

Here in South Africa all the banks I know of moved away from SMS text messages for 2FA ages ago, and perform authentication in-app with biometrics instead. Having a banking app installed on your phone is pretty much mandatory, and criminals have no doubt grown wise to this fact. So what happens when someone holds a gun to your head and forces you to perform a large transfer of funds from your phone? I'm sure the banks will try convince you that their fraud detection systems will come to your aid.

One bank here recently introduced a duress-PIN, which when entered, will commence monitoring and send help, but they still don't offer any guarantee of a refund. Another bank allows you to change their app's icon and name, in an effort to masquerade as something less recognisable.

I'd much rather delete the apps, unlink my devices from my bank accounts and use a TOTP authenticator app instead.

Re: Why are banks still getting authentication so wrong?

#194

Post by rs186 »

charcircuit wrote: post #77
gtkspert wrote: post #42

You have to think of a Bank's threat model though. Account compromise is one threat, but the use of valid accounts for money laundering is another. In my view the reason they "get it wrong" is because they don't want you to be able to automate transactions, as that makes money laundering easier... Therefore, they don't want to use standard TOTP because that's easy to automate. Requiring SMS based 2FA is harder (but n…

Why would a bank care about money laundering?

I think you can easily answer that question yourself by doing a simple search.

Re: Why are banks still getting authentication so wrong?

#195

Post by Yizahi »

bee_rider wrote: post #36
bryanlarsen wrote: post #4

Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.

My rule is simple: if you contact me, you are the one that had to authenticate. Otherwise you are probably a scammer. Although, I haven’t had many instances of communications from my bank where I cared about them authenticating. Like, if they tell me there is a problem, I can go check it out through the app, website, or whatever the user-initiated channel is. When I feel like it.

Can be both. You need something from a bank (for example a money transfer), and they call you to confirm. In my case this is 99% of all incoming bank calls to me.

Re: Why are banks still getting authentication so wrong?

#196

Post by loeg »

kortilla wrote: post #154
loeg wrote: post #120

Earlier quoted context omitted.

And it is a significant flaw of the US model!

Not if you ask people who specifically don’t want the government tracking everything

They are deluded if they think the lack of federal ID (ignoring Social Security) provides any privacy benefit, and the cost is immense.

Re: Why are banks still getting authentication so wrong?

#198

Post by kube-system »

sir_brickalot wrote: post #184
sedatk wrote: post #67

Earlier quoted context omitted.

Also, people usually underestimate the problems of TOTP. Losing TOTP is easy. Lose your phone and it's gone. It means game over for a regular person. SMS is light years ahead in terms of ease of recovery. Even after losing your phone, you can stop by a store, activate your SIM back again with your ID. Not the case with TOTP. Yes, some of the SMS recovery scenarios can make hackers hijack your account easily too, but…

Counter: Backups for TOTP are easy and you can use multiple devices/services for a single TOTP login.

Whether it is easy or possible is irrelevant. For the 99.7% of the world that isn't a software developer, the real-world observed use case will predominantly be the least-friction commoditized workflow. People mostly have one phone with one authenticator app, and that's what they'll use.

Re: Why are banks still getting authentication so wrong?

#199

Post by Yizahi »

blitzar wrote: post #125
bryanlarsen wrote: post #4

Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.

> they still expect you to authenticate when they phone you Why has some startup not solved this problem already?

There are 3 hard problems in Computer Science after all :) /s

Re: Why are banks still getting authentication so wrong?

#200

Post by hinkley »

patrakov wrote: post #108
hinkley wrote: post #20

Earlier quoted context omitted.

It was a proud day when my bank stopped sending emails with links in them. Of course their outsourced fraud prevention dept still calls and leaves messages with callback numbers, or just asks me for PII. Fuck off. Send people to the website to find your number, idiots.

My bank also promises to never send links. Instead, it sends all of its messages as images without any alt text, and these images sometimes contain links to retype.

Letter of the law: [x]

Spirit of the law: [ ]

Post reply on HN