4 ms·
In the Netherlands, most banks use a system that depends on the security of the chip-debit card, and a specific hardware device that each customer gets sent. I
by rocqua 9y ago
In the Netherlands, most banks use a system that depends on the security of the chip-debit card, and a specific hardware device that each customer gets sent.
In my case (rabobank), whenever the bank needs authentication (i.e. when logging in, transfering money, or changing details) they present me with a QR-like code. I then use their supplied hardware [1]. This requires I enter my card and enter my PIN.
I can then scan the QR-ish code with a camera built into the device.
The device then prompts me with what I am doing. Something like "You are sending € X to account Y " or "Login into account Z". Upon clicking confirm, it outputs a numerical code I have to enter into the website.
I really love this system, I like it the best of all dutch systems I know.
One bank I know of (ANB-amro) has a similar hardware device, without using the QR codes, but numbers you enter. They also provide a USB connection so you don't need to enter numerical codes twice.
Another bank I know of uses standard password and SMS 2-factor authentication.
The mobile app for rabobank is quite a bit worse though. You need the scanner once to set up a PIN on the device. With that PIN, you can immediately login and see all account details. Moreover, small amounts to accounts you've previously sent money too can be sent using only that PIN.
The idea being that these are your 'friends' and it is nice to pay your friends quickly.
There is even a setting that will allow you to send amounts below a threshold (I think €100) to any account using only that PIN.
Luckly, you can turn that off, and it takes the scanner to turn it back on. However, you cannot turn of the transfer to 'friends' unless you simply refuse to install the app.
[1] dutch wikipedia link: https://nl.wikipedia.org/wiki/Rabo_Scanner https://nl.wikipedia.org/wiki/Rabo_Scanner
- ktpsns 9y agoIn Germany, we have the same system (Tan Generator, https://en.wikipedia.org/wiki/Transaction_authentication_number#TAN_generators https://en.wikipedia.org/wiki/Transaction_authentication_num...). Actually, some banks provide Mobile TANs but we all know that this is eyewash with smartphones, whereas a Tan generator is an independent offline device. However, there are also a number of loopholes. I can make a batch transfer of an arbitrary amount of money to a number of recipients with only a single TAN and this is not well integrated into the TAN generator device.
- zaarn 9y agoThere is also smart@TAN or OptiTAN. It's essentially a 5€ device with photosensitive diodes that you press on your screen and print out the TAN. IMO it's the best option if you don't want to use HBCI and Co.
- Cenk 9y agoI use one of those (it looks like this[0]) and am quite happy with it, especially compare to my Swedish bank account that uses a similar device (DigiPass [1]) but all the numbers have to be entered manually. [0]: https://i.ebayimg.com/images/g/gtoAAOSw5zNalXj7/s-l300.jpg https://i.ebayimg.com/images/g/gtoAAOSw5zNalXj7/s-l300.jpg [1]: https://img3.mp-farm.com/3458223.jpg?w=500&h=375&v=3 https://img3.mp-farm.com/3458223.jpg?w=500&h=375&v=3
- zaarn 9y agoI basically got the first device. Very cheap and easy to use (unless you got your monitor out of arms reach, in this case I have to move the blinkenlicht to a monitor I can reach)
- mseebach 9y agoIn the UK, CAP devices are common, that allow you to complete a PIN-verified numeric challenge response. https://en.wikipedia.org/wiki/Chip_Authentication_Program https://en.wikipedia.org/wiki/Chip_Authentication_Program
- lucb1e 9y ago> I really love this system I would much prefer to just have a username and password. Now I need to carry two devices (scanner and chip) and enter my PIN every single time I want to do anything. This gives it a huge amount of exposure for shoulder surfing, especially since this scanner thing has touch buttons (how are you ever going to enter anything on a touchscreen-like device without looking at it? The old device had buttons which you could press under the table or so). This system is good for most people, but not for everyone. What I mind is the inflexibility.