Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are banks still getting authentication so wrong?

jamal.haba.sh

Post reply on HN
Print view View original

291–300 of 375 posts

Re: Why are banks still getting authentication so wrong?

#291

Post by raron »

sedatk wrote: post #67
gtkspert wrote: post #42

You have to think of a Bank's threat model though. Account compromise is one threat, but the use of valid accounts for money laundering is another. In my view the reason they "get it wrong" is because they don't want you to be able to automate transactions, as that makes money laundering easier... Therefore, they don't want to use standard TOTP because that's easy to automate. Requiring SMS based 2FA is harder (but n…

Also, people usually underestimate the problems of TOTP. Losing TOTP is easy. Lose your phone and it's gone. It means game over for a regular person. SMS is light years ahead in terms of ease of recovery. Even after losing your phone, you can stop by a store, activate your SIM back again with your ID. Not the case with TOTP. Yes, some of the SMS recovery scenarios can make hackers hijack your account easily too, but…

> Losing TOTP is easy. Lose your phone and it's gone.

That is the main point of it. That's why it is called a second factor.

> It means game over for a regular person.

It just means you have to go to the nearest branch.

Re: Why are banks still getting authentication so wrong?

#292

Post by ilaksh »

kube-system wrote: post #225
ilaksh wrote: post #65

I don't care how many times I am violently buried on this site for mentioning the word -- but cryptocurrency makes traditional banking obsolete. Or should have.

cryptocurrency makes traditional banking obsolete only if: 1. you don't understand what banks do, or 2. you pretend that cryptocurrencies do things that they don't One could make a list a mile long of things that banks do that cryptocurrencies have no answer for. Banking is not a technology, it is a service.

Maybe try to make a list of 1 or 2 things instead of a mile.

Re: Why are banks still getting authentication so wrong?

#293

Post by homebrewer »

matthewdgreen wrote: post #256
bee_rider wrote: post #36

Earlier quoted context omitted.

My rule is simple: if you contact me, you are the one that had to authenticate. Otherwise you are probably a scammer. Although, I haven’t had many instances of communications from my bank where I cared about them authenticating. Like, if they tell me there is a problem, I can go check it out through the app, website, or whatever the user-initiated channel is. When I feel like it.

It is such a goddamned tragedy that we’ve come to this. And also an avoidable one: every E2E messaging app (WhatsApp, Android Messages, iMessage) should be able to properly authenticate the caller. But I presume services are asking too much money for this, and nobody wants to hand yet another vital service to Apple/Google/Meta. So instead we all suffer.

Be careful what you wish for. This problem is solved in China — you can contact many government agencies and major companies over WeChat and be sure that you're talking to the real entity, but the downside is that WeChat has a copy of your passport and knows everything about you.

Re: Why are banks still getting authentication so wrong?

#294

Post by lxgr »

Henchman21 wrote: post #282
lxgr wrote: post #228

Earlier quoted context omitted.

Well, I’m not doing business with a company that trusts any random phone carrier’s identity assertion more than me in determining what is and isn’t my phone number, so I guess it works out nicely. And if a company can’t be bothered to have a fallback verification flow in case I do lose access to my phone number somehow, that doesn’t increase confidence either. I’m a person, not a phone number.

So, if I may ask, do you have a smartphone? What kind and who is your carrier? It seems to me your stance would preclude owning a smartphone?

I do, but that doesn't mean I need to participate in ridiculous forms of authentication.

Re: Why are banks still getting authentication so wrong?

#295

Post by socalgal2 »

My apartment wanted to use some 3rd party service to do ACH transfers for my rent. I just wanted to type in my bank's routing number and account number but this 3rd party service only worked if you gave it your bank username/password. I was like NOPE! And sent them a paper check. My guess is they had some permission from the bank to also suck down all your transaction history.

I'm too lazy to look up the service but it's a famous/popular service along the order or plaid or something

Re: Why are banks still getting authentication so wrong?

#296

Post by lxgr »

kortilla wrote: post #290
lxgr wrote: post #264

Earlier quoted context omitted.

Ironically, lax to nonexistent data privacy laws and the ubiquitous use of SSNs as globally unique identifiers are achieving exactly the outcome that the lack of government ID verification purportedly achieves.

You don’t need an externally generated globally unique ID verified by the government.

You definitely need a unique ID assigned by the government for pretty much anything involving money or healthcare in the US.

Re: Why are banks still getting authentication so wrong?

#297

Post by lxgr »

kortilla wrote: post #287
lxgr wrote: post #263

Earlier quoted context omitted.

> You can’t have privacy if everyone uses the government as an SSO. Why not? Anonymous cryptographic attestation methods (e.g. of only the fact that you are over 18 years old, that you are a permanent resident etc.) exist.

It’s technically possible but none of the govt implementations I’ve seen do this.

The German ID card has been supporting privacy-preserving remote age attestation for over a decade, for example.

These days, every smartphone with an ISO 1443 interface ("NFC") can act as a reader.

Re: Why are banks still getting authentication so wrong?

#298

Post by peterldowns »

aucisson_masque wrote: post #262

I'd be curious to know what bank does actually proper authentification ? Like 2fa with otp code or passkey. I went through quite a few bank in my life, some old style bank, some all internet bank, they were all some shade of horrible. Neither offered proper authentification method.

Vanguard on Web supports Passkeys for 2fa, but the iOS app seems to only support text-sms 2fa.

Robinhood supports passkey login on iOS app but doesn’t seem to require it for 2fa, email+password succeeds with no further prompts. But on Web it doesn’t support passkey at all, and email+password requires you to confirm auth via an in-app notification.

Both Robinhood and Vanguard support FaceID biometric auth for their apps.

All I want is passkey auth everywhere and/or email+password with options for passkey and TOTP for 2fa.

Ugh.

Re: Why are banks still getting authentication so wrong?

#299

Post by jacobgkau »

xienze wrote: post #61
xp84 wrote: post #47

Earlier quoted context omitted.

This is no excuse for not offering it. And no, SMS must NOT be a backup that’s always available, as the article points out, its availability for use is a security hole. If you can’t access your actual 2FA there should be an option for the bank to have it call that registered number and ask you “Hey this is (Bank). Are you trying to log in right now from Moscow on a Windows 10 PC using Firefox? If so, please call the…

> “Hey this is (Bank). Are you trying to log in right now from Moscow on a Windows 10 PC using Firefox? If so, please call the number on the back of your card, hit 9, put in your SSN, then we’ll turn off 2FA for one login and let you add a new one. Btw if it is not you, your password is definitely compromised.” Stop, do not pass Go, do not collect $200. Having someone call and ask for your SSN is a non-starter. And i…

> Having someone call and ask for your SSN is a non-starter.

That's not what he said. This hypothetical robocall would simply instruct you to call a different (known good, printed on your card) number to authenticate, at which point you know who's on the line.

> And in what world is SMS not available but being able to call that same phone is?

It's a good point about the robocall notification itself, but I imagine this kind of system wouldn't even need that to work in order to function. What actually unlocks your account is calling the bank's system and inputting your SSN; you could preemptively do it from another phone if you know you lost your 2FA codes and are trying to log in.

This person's idea would replace your phone number being your authentication with your phone number simply being used for a notification, shifting the actual authentication to something the bank already knows but that someone who stole your credit card (and maybe your phone along with it) wouldn't inherently have. I got a bad whiff from it at first, but after thinking about it a little more, I think it's a good idea.

Re: Why are banks still getting authentication so wrong?

#300

Post by nmca »

Muromec wrote: post #270
nmca wrote: post #244

Earlier quoted context omitted.

I know this was sarcasm, but bank card is not appropriate because you should have one hardware key for all services produced by an independent provider.

Why would I want to have one key for all them? To lose access or get them all compromised at the same time?

I think your threat model is bad — the isolation of accounts offers little and most people have effectively only the security of their email provider anyway.

That said, buying several keys would be a natural and happy path solution for the paranoid. Make sure to get three for each account (same as primary) as either you need a backup or the extra key offers no extra security.

Post reply on HN