5 ms·

Today gmail offers more account security than a typical bank. Why can I get two factor authentication, device recognition and alerts on a free email account but

by slv77 10y ago

Today gmail offers more account security than a typical bank. Why can I get two factor authentication, device recognition and alerts on a free email account but not on a bank account? From a risk management perspective it's never a good idea to separate liability from control. If the banks don't provide adequate security controls to their customers why should their customers be liable? Even though the controls that a customer has are less than what Gmail provides the banks continue to push the the illusion that the customer is actually in control. Even the vocabulary they use implies the customer was always in control. For example you were a victim of identity theft. How crazy is that? How can somebody steal my identity? Oh, I woke up this morning and I wasn't me!!! Nope.. Checked my identity and I'm still me. Why did you allow somebody to steal all my money?

sjtgraham 10y ago
> Today gmail offers more account security than a typical bank. Why can I get two factor authentication, device recognition and alerts on a free email account but not on a bank account? Barclays UK does device identification. Barclays is actually very sophisticated technologically speaking. Source: I reverse engineered their app to implement my own API client.
- imrehg 10y ago
  That's cool! Any repo where it can be checked out, or is it just for personal use?
eyelidlessness 10y ago
Not to give banks any wiggle room, but I would argue that gaining access to random Gmail accounts poses a greater risk to most people than gaining access to random bank accounts, because the former is a superset of the latter. Since email is used as the focal point of trust in most online transactions, it should be the most secure.
rainhacker 10y ago
> Today gmail offers more account security than a typical bank This could be one of the reasons why Google is seen as biggest threat by retails banks. If Google starts providing retail banking service, I would prefer them to sluggish retails banks which sees technology as a cost center and most are embarrassingly lagging in technical advancements.
- dmichulke 10y ago
  This would be a privacy nightmare and probably exactly fit their business model. I wonder why they aren't doing it.
  - nxzero 10y ago
    Google for years has tried to offer payments services. Banking requires customer service and is highly regulated - both things that Google dislikes.
tomjakubowski 10y ago
> Today gmail offers more account security than a typical bank. Why can I get two factor authentication, device recognition and alerts on a free email account but not on a bank account? I have all of those things with a standard checking account from Chase. I do wish that I could use Google Authenticator/TOTP for 2FA rather than texts/emails, though.
kalleboo 10y ago
Out of my 5 banks, 3 use physical 2fa RSA tokens (and 2 support 2fa apps) and 2 use those crappy code cards for 2fa. Are American banks really that bad?
- kalleboo 10y ago
  I just read the original referenced story about the woman who got defrauded. It definitely couldn't happen with my former main bank - they will not allow any kind of ID aside from in-person photo ID or 2FA, to the point where my parents are actually locked out of their account since the battery ran out in their 2FA device, they never set up a mobile app 2FA, and they live abroad so they can't go into an office. The bank actually told them "tough luck, you're going to have to fly across half the planet to get the 2FA device replaced". My parents are obviously upset, but I thought it was pretty impressive.
  - Spooky23 10y ago
    That's not impressive, that's security run amok. Unless these bank people know you personally, it's just a way to make certain frauds a little harder while making other, very common frauds much easier.
    - kalleboo 10y ago
      > other, very common frauds Is this also coming from a US perspective, where photo ID is basically useless and everyone relies on a "secret" number (SSN) that was specifically not meant to be used for identification?
      - nxzero 10y ago
        The SSNs aren't even secret, it's trivial to get someone's SSN using public information: https://news.ycombinator.com/item?id=10394881 https://news.ycombinator.com/item?id=10394881
        10y ago
deleted 10y ago
[deleted]

by slv77 10y ago

sjtgraham 10y ago

> Today gmail offers more account security than a typical bank. Why can I get two factor authentication, device recognition and alerts on a free email account but not on a bank account? Barclays UK does device identification. Barclays is actually very sophisticated technologically speaking. Source: I reverse engineered their app to implement my own API client.

imrehg 10y ago
That's cool! Any repo where it can be checked out, or is it just for personal use?

eyelidlessness 10y ago

Not to give banks any wiggle room, but I would argue that gaining access to random Gmail accounts poses a greater risk to most people than gaining access to random bank accounts, because the former is a superset of the latter. Since email is used as the focal point of trust in most online transactions, it should be the most secure.

rainhacker 10y ago

> Today gmail offers more account security than a typical bank This could be one of the reasons why Google is seen as biggest threat by retails banks. If Google starts providing retail banking service, I would prefer them to sluggish retails banks which sees technology as a cost center and most are embarrassingly lagging in technical advancements.

dmichulke 10y ago
This would be a privacy nightmare and probably exactly fit their business model. I wonder why they aren't doing it.
- nxzero 10y ago
  Google for years has tried to offer payments services. Banking requires customer service and is highly regulated - both things that Google dislikes.

tomjakubowski 10y ago

> Today gmail offers more account security than a typical bank. Why can I get two factor authentication, device recognition and alerts on a free email account but not on a bank account? I have all of those things with a standard checking account from Chase. I do wish that I could use Google Authenticator/TOTP for 2FA rather than texts/emails, though.

kalleboo 10y ago

Out of my 5 banks, 3 use physical 2fa RSA tokens (and 2 support 2fa apps) and 2 use those crappy code cards for 2fa. Are American banks really that bad?

kalleboo 10y ago
I just read the original referenced story about the woman who got defrauded. It definitely couldn't happen with my former main bank - they will not allow any kind of ID aside from in-person photo ID or 2FA, to the point where my parents are actually locked out of their account since the battery ran out in their 2FA device, they never set up a mobile app 2FA, and they live abroad so they can't go into an office. The bank actually told them "tough luck, you're going to have to fly across half the planet to get the 2FA device replaced". My parents are obviously upset, but I thought it was pretty impressive.
- Spooky23 10y ago
  That's not impressive, that's security run amok. Unless these bank people know you personally, it's just a way to make certain frauds a little harder while making other, very common frauds much easier.
  - kalleboo 10y ago
    > other, very common frauds Is this also coming from a US perspective, where photo ID is basically useless and everyone relies on a "secret" number (SSN) that was specifically not meant to be used for identification?
    - nxzero 10y ago
      The SSNs aren't even secret, it's trivial to get someone's SSN using public information: https://news.ycombinator.com/item?id=10394881 https://news.ycombinator.com/item?id=10394881
      - 10y ago

deleted 10y ago

[deleted]