Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are banks still getting authentication so wrong?

jamal.haba.sh

Post reply on HN
Print view View original

221–230 of 375 posts

Re: Why are banks still getting authentication so wrong?

#221

Post by SoftTalker »

lxgr wrote: post #211
fkyoureadthedoc wrote: post #34

Earlier quoted context omitted.

Recently had to call Discover because of unauthorized use of card, apparently to buy Facebook ads of all things. They didn't call me, just locked my account and said I had to call them. I couldn't even pay the balance until I did. Anyway they needed to verify my identity, so they ask me for some info from the back of the card and a phone number that they can send the OTP to. I give them a phone number, it's not even…

> and a phone number that they can send the OTP to. I give them a phone number, it's not even the one on the account, they send the text to it. This regularly blows my mind. Presumably it’s some data broker or phone carrier integration, because for me, the answer is usually “sorry, we can’t verify that number, is this a postpaid contract in your name?” No, it’s not. Oh, that’s a requirement for doing business with yo…

People get new phones and new phone numbers. Frequently, compared to landline days. The alternative is to be permanently locked out of everything if you get a new phone number.

Re: Why are banks still getting authentication so wrong?

#222

Post by g_p »

fn-mote wrote: post #202
wodenokoto wrote: post #45

Earlier quoted context omitted.

When calling my bank I have to enter my entire CC number AND my PIN code. Talk about training people to give away sensitive data.

> When calling my bank I have to enter my entire CC number AND my PIN code. YOU calling THEM is not an issue. That's the secure connection. There's not (afaik) a way to hijack the receiving phone number. The issue is when somebody calls YOU. Faking the originating number of a phone call is easy, happens all of the time. That's the scammer route.

There are absolutely ways to intercept a call from a targeted user that would be viable to use to gain access to a mid to high value user's funds.

SS7 call routing and rogue 2G base stations are some potential approaches.

In terms of banking security, a good (ideal) architecture would treat the user PIN as a credential which is not transmitted over insecure means. Unfortunately many banks don't do this right, and still support bank-side PIN verification (with the PIN sent over the wire to the bank), rather than using the bank card's smart card features to carry out on-chip PIN verification.

If you built a bank from scratch, for security first, you'd likely still use smart cards as bank cards, but you'd only do PIN verification on-card, so the user PIN is never exposed to even the bank - the card can securely vouch for the PIN in a manner that's far more costly for an attacker to defeat than using a $5 wrench against the user of the card to make them reveal the PIN (h/t to XKCD).

Sending the card number and PIN over the phone is just asking for trouble - mobile phone calls are decrypted at the base station and available in the clear, before being transmitted up into the wider telecoms network.

Re: Why are banks still getting authentication so wrong?

#223

Post by Muromec »

charcircuit wrote: post #77
gtkspert wrote: post #42

You have to think of a Bank's threat model though. Account compromise is one threat, but the use of valid accounts for money laundering is another. In my view the reason they "get it wrong" is because they don't want you to be able to automate transactions, as that makes money laundering easier... Therefore, they don't want to use standard TOTP because that's easy to automate. Requiring SMS based 2FA is harder (but n…

Why would a bank care about money laundering?

Because the government said so. Why did the government say so -- because the bank is the only place that can see your transactions and has a profile on you and has a dedicated person to call you and ask about that cash withdrawal on the Turkish side of the Syrian border or regular cash deposits of 100k each week in addition to your cop salary.

Alternatively you can just not do anything with money laundering and all that or let the government do the monitoring itself.

Re: Why are banks still getting authentication so wrong?

#224

Post by kube-system »

idontcareatall wrote: post #176
delusional wrote: post #11

What actual real life person is going to switch their bank account because TOTP isn't supported? That's why banks get authentication wrong. Because they are in the business of banking and banking customers do not care about TOTP.

Me? As in, I've literally changed banks and canceled cards over this. I can't get SMS when I'm traveling which is 95% of my time. It's such an entirely ignorant US-centric view to assume that everyone has a phone, has SMS plans, has cell service at all, etc.

> It's such an entirely ignorant US-centric view to assume that everyone has a phone, has SMS plans, has cell service at all, etc.

I think many banks might find it a benefit to exclude customers who don't have cellphones or SMS.

Re: Why are banks still getting authentication so wrong?

#225

Post by kube-system »

ilaksh wrote: post #65

I don't care how many times I am violently buried on this site for mentioning the word -- but cryptocurrency makes traditional banking obsolete. Or should have.

cryptocurrency makes traditional banking obsolete only if:

1. you don't understand what banks do, or

2. you pretend that cryptocurrencies do things that they don't

One could make a list a mile long of things that banks do that cryptocurrencies have no answer for. Banking is not a technology, it is a service.

Re: Why are banks still getting authentication so wrong?

#227

Post by Muromec »

pasttense01 wrote: post #128
Muromec wrote: post #82

Earlier quoted context omitted.

If only there was some kind of a physical tokem with a crypto key that is protected by a password and tied to one's bank account. -s

Some of us don't want to have a dozen plus separate physical tokens (one for each of bank/credit card/tax, etc sites with sensitive financial information we have).

Okay, I will make the "S" mark bigger next time.

Re: Why are banks still getting authentication so wrong?

#228

Post by lxgr »

SoftTalker wrote: post #221
lxgr wrote: post #211

Earlier quoted context omitted.

> and a phone number that they can send the OTP to. I give them a phone number, it's not even the one on the account, they send the text to it. This regularly blows my mind. Presumably it’s some data broker or phone carrier integration, because for me, the answer is usually “sorry, we can’t verify that number, is this a postpaid contract in your name?” No, it’s not. Oh, that’s a requirement for doing business with yo…

People get new phones and new phone numbers. Frequently, compared to landline days. The alternative is to be permanently locked out of everything if you get a new phone number.

Well, I’m not doing business with a company that trusts any random phone carrier’s identity assertion more than me in determining what is and isn’t my phone number, so I guess it works out nicely.

And if a company can’t be bothered to have a fallback verification flow in case I do lose access to my phone number somehow, that doesn’t increase confidence either. I’m a person, not a phone number.

Re: Why are banks still getting authentication so wrong?

#229

Post by SoftTalker »

anon7000 wrote: post #75
eptcyka wrote: post #32

Earlier quoted context omitted.

It's stupid to give out credentials over the phone, but it's stupider still to have a system where one's birth date is a credential that is supposed to remain confidential.

I mean this is basically the ENTIRE US health system

Yeah but nobody really cares about your health info. They care about your bank account info though.

Re: Why are banks still getting authentication so wrong?

#230

Post by mixmastamyk »

taco_emoji wrote: post #150
noleary wrote: post #138

> I don’t think anyone considers a bank account “low-risk.” Yet here we are, still relying on SMS as the default, and sometimes only, 2FA option > Passkeys (FIDO2/WebAuthn): Phishing-resistant, device-based login using biometrics. Excellent UX and security. In response to the complaints about SMS MFA, yeah, it has its issues (we don't even support it in our auth software) but it's not totally indefensible. It makes i…

> People really don't understand passkeys Passkey UX is absolutely terrible. It's unclear what is happening, what is being stored where (do you have my passkey? do I? is it in my browser? is it on my phone?), how communication is happening between devices, etc. Also nobody seems to explain what exactly a passkey is . Where's the thing I can point at and say "that's your passkey"?

I didn't understand it either, but on the "Security Now" podcast Steve said it's basically like using a FIDO2 key but virtualized in software. As I've used a yubikey and understand public/private keys (with ssh) I now have a vague idea.

As the sibiling comment alludes, FLOSS projects have been threatened for allowing (part of?) the key to be exported!

Post reply on HN