The Convenience Trap: Why Seamless Banking Access Can Turn 2FA into 1FA

Post by OutOfHere » Wed, Jul 30, 2025, 2:02 AM UTC

jpc0 wrote: post #47

OutOfHere wrote: post #24

Passkeys seem overrated for three reasons: (1) Their use of public-key cryptography is not quantum safe (against quantum computing). In contrast, passwords are very much quantum safe. (2) They are tied to the provider. Why on Earth would I want to have the provider own my passkeys? Why would I want this vendor lock-in for my authentication? (3) What if I want multiple accounts for a site? Some passkey vendors may sup…

1. Neither are passwords… Unless you use a quantum safe hashing algorithm which I believe I’ve only seen Apple adopt, maybe others but most of the internet isn’t using it. 2. By definition this isn’t true 3. Again not true, don’t confound whatever terrible implementation you have used with what is allowed or capable

Post by oytis » Wed, Jul 30, 2025, 8:03 AM UTC

deredede wrote: post #10

The article starts with this description of 2FA: > an electronic authentication method in which a user is granted access to a website or application only after successfully presenting two or more distinct types of evidence (or factors) to an authentication mechanism. and concludes with (emphasis mine): > For the average user, the smartphone has become a single point of failure, where the theft of one device and one p…

Post by zarzavat » Wed, Jul 30, 2025, 9:32 AM UTC

frollogaston wrote: post #46

zarzavat wrote: post #38

Earlier quoted context omitted.

Buy an older iPhone for ~$150. Install financial apps on it and don't use it for anything else. Keep it in a safe place, only carry it around if you must. If you need to manage non-trivial amounts of money through your phone, having a specific device to do that is a no-brainer.

Is the risk that someone's going to steal my phone, forcibly hold it to my face, and wire my money somewhere? So far I've known two close friends who got mugged, the robber didn't think of this. Last time I tried intentionally wiring a large amount of money to someone, it took forever and involved tons of approval.

Post by Yeul » Wed, Jul 30, 2025, 10:58 AM UTC

zarzavat wrote: post #55

frollogaston wrote: post #46

Earlier quoted context omitted.

Is the risk that someone's going to steal my phone, forcibly hold it to my face, and wire my money somewhere? So far I've known two close friends who got mugged, the robber didn't think of this. Last time I tried intentionally wiring a large amount of money to someone, it took forever and involved tons of approval.

It's common in London, phones are being stolen for the access to financial accounts, not the value of the phone itself. They steal the phone out of your hands while it is unlocked. For example: https://www.bbc.com/news/articles/cy8y70pvz92o.amp I'm not sure exactly how they get around security features, perhaps by social engineering customer support, if they have enough PII.

Post by burnt-resistor » Wed, Jul 30, 2025, 11:59 AM UTC

Shank wrote: post #12

politelemon wrote: post #11

> Passkeys, particularly when bound to a physical security key And _only_ when bound to a physical security key. Unfortunately by tying into the marketing of passkeys, there is going to be a pervasive assumption that ecosystem/on-device passkeys are just as secure. Overall a good set of points, and I think it highlights the issues with a lot of the lauded 'convenience' factors in the Apple ecosystem.

> Unfortunately by tying into the marketing of passkeys, there is going to be a pervasive assumption that ecosystem/on-device passkeys are just as secure. Passkeys are an improvement over passwords. Security keys have a place for high security applications like enterprise deployments or the security paranoid. Passkeys stored on security keys can be trivially made worse by allowing users to set bad PINs (like 0000). I…