Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are banks still getting authentication so wrong?

jamal.haba.sh

Post reply on HN
Print view View original

271–280 of 375 posts

Re: Why are banks still getting authentication so wrong?

#271

Post by michaelt »

deathanatos wrote: post #258
pc86 wrote: post #167

Earlier quoted context omitted.

This is fine for services you can easily access on a phone or computer. My employer requires I change my laptop password every 60 days, it stores the last 2 years of passwords to prevent reuse. I am not opening up LastPass and plugging in a 32 character random string every time I want to start my computer up. My password at any given point is either a few random words and a number, or a short (8-12 character) alphanu…

I once joked (I think because my employer had a similar, crazy requirement) that my keyboard's firmware was programmable, and I could just reprogram that FW so that Level3Shift+some key would rattle off the month's password. Obviously, this is a terrible idea.

Believe it or not, "Yubikey" security keys have about 8 different configurable modes. One of them is "emulate a USB keyboard and enter a static password".

So not only could you implement your idea - you could also tell people you "log in with a yubikey" and they'll think you're at the forefront of security.

Re: Why are banks still getting authentication so wrong?

#272

Post by lxgr »

Detrytus wrote: post #165
878654Tom wrote: post #131

Earlier quoted context omitted.

And I love that requirement. I do banking on my desktop and to confirm the transfers I get a push notification from a third-party application (ItsMe, so not a banking mobile app) with all the information I have entered. I can confirm the transaction from a complete separate device while doing a second check if all details are correct.

The requirement per se is not the biggest problem. Implementation by different banks is. In my country I have several bank accounts. One bank allows me to install mobile app on up to 5 smartphones, all I need is connect the smartphone to the Internet (e.g. through Wi-Fi). Another bank allows me to have up to 3 smartphones, but identifies them by phone number, so it forces me to have 3 difrerent SIM cards Yet another…

And that's to say nothing about what happens when changing phones...

Re: Why are banks still getting authentication so wrong?

#273

Post by progmetaldev »

aucisson_masque wrote: post #262

I'd be curious to know what bank does actually proper authentification ? Like 2fa with otp code or passkey. I went through quite a few bank in my life, some old style bank, some all internet bank, they were all some shade of horrible. Neither offered proper authentification method.

In the US, I am seeing biometric authentication, and/or 2fa on mobile apps for financial institutions. The issue is that these same institutions are still running their websites that have the same security that was around in the early 2000's. You can take advantage of the mobile application and get better security, but you're still a target to someone that just accesses the website.

Re: Why are banks still getting authentication so wrong?

#274

Post by crazygringo »

matthewdgreen wrote: post #257
crazygringo wrote: post #249

Earlier quoted context omitted.

What is the issue? That's literally just your account number and the password. That's what you're supposed to do. That's what security is. That's the sensitive data that ensures it's not a rando calling who stole your card. I'm not sure what alternative you are looking for? You're the one calling them, so it's fine.

The passcode to call your bank for basic customer service probably shouldn’t be the same passcode that lets people spend money on your account. Even TOTP is better than this.

Why not?

Basic customer service lets you do things like transfer money too, so you need something just as secure as a PIN.

So why would you want two different security mechanisms? Either it's you or it's not.

Re: Why are banks still getting authentication so wrong?

#275

Post by lxgr »

physhster wrote: post #117

Bank of America offers FIDO U2F as a second factor but doesn't let you remove SMS as a factor. I don't see what the point is.

It doesn't do anything about SMS delivery based threats, but U2F at least makes authentication itself unphishable.

Re: Why are banks still getting authentication so wrong?

#276

Post by yencabulator »

bryanlarsen wrote: post #4

Also, they still expect you to authenticate when they phone you. No, I'm not going to tell you my birthday when you phone me. No wonder so many people get scammed, when banks are training people on how to get scammed.

Ask for a case number, write it down, hang up, call the number on your card, say you have a case number.

Re: Why are banks still getting authentication so wrong?

#277

Post by no_wizard »

prepend wrote: post #146
dfxm12 wrote: post #52

Earlier quoted context omitted.

I had someone ask for my name. I told them my first and last name. They said it wasn't correct. After a few minutes of discussion, it turns out the person wanted my name as it appeared on my card , which is first name, middle initial, last name and a suffix. I told the person as feedback that what they asked for and what they wanted were two different things. I'm not optimistic that anything will change.

It will improve once we have AI smarter than agents who work for the wages banks pay for this. The weakness is in the processes and the lack of critical thinking skills of people executing processes.

No it’s the lack of the banks setting up incentives that allow these agents to act in a better manner.

They have metrics and bosses. They do what they’re instructed to do by the banks, full stop. Or likely more precise the company that the bank contracted for the service.

It’s dehumanizing to suggest these folks lack critical thinking skills, given the incentives of the whole thing from the top down incentives their behavior. They’re only responding to the incentives of the system

Re: Why are banks still getting authentication so wrong?

#278

Post by nand_gate »

einarfd wrote: post #169
snowwrestler wrote: post #48

Earlier quoted context omitted.

In the U.S., identity providing is not a role the government fills. Not everyone has to have a passport, for example. A passport is merely a purpose-specific tool for crossing borders, not general identity.

In Norway our BankID system, which is similar to what the Danes have, is owned by the banks, and is a run by a private company. While I personally think that in principle it should be run by the government. It works well enough, and it is imo. proof that it does not have to be run by the government.

Isn't being run by a bank just a roundabout way to be run by the gov't?

Your root of trust for said bank id is gov't documents, right?

Re: Why are banks still getting authentication so wrong?

#280

Post by hamburglar »

9x39 wrote: post #259
hamburglar wrote: post #188

Earlier quoted context omitted.

The only solution to this problem is to put your password on a post-it note in the most obvious place possible? Are we sure the CISO is the idiot in this story? This sounds like malicious negligence. I sure hope nothing that actually matters is on your system.

Well, a TPM would eliminate this user-hostile auth dance, although that security model is different than a password. Failing to recognize and channel human behavior into positive behaviors and outcomes does suggest a level of ignorance/arrogance outside of extreme situations. There’s probably a type of data one might handle to justify physical access threat models, but incompetence and out of date knowledge from thes…

I think it’s valid to question the wisdom of a CISO using misguided password guidelines. I don’t think it’s valid to respond to guidelines you disagree with by willfully sabatoging security. You relinquish your righteous position on password security when you put your password on a post-it in your laptop.
Post reply on HN