5 ms·

Nor does TD. They don't even do phone notifications of logins. Ironically i signed up with one of the local credit unions in Toronto to take advantage of a hig

by verelo 8y ago

Nor does TD. They don't even do phone notifications of logins. Ironically i signed up with one of the local credit unions in Toronto to take advantage of a high interest savings account for a future tax debt of which I am sitting on the cash for, and found they supported SMS 2FA, and texts when anyone (even me) logged into the account. I wish TD supported this, but then again, as long as their money is backed by the government i don't really care all that much.

ams6110 8y ago
SMS as a 2FA has been discredited, but I suppose it's better than nothing.
- ahelwer 8y ago
  Nope, it's worse. Websites will use it as an authentication method in password-reset workflows, which means hacking your account reduces to intercepting or redirecting text messages (easily accomplished). Rampant cryptocurrency theft over the past year has conclusively demonstrated that SMS-based 2FA is worse than no 2FA at all. The worst offender? Gmail. It uses your phone number for password recovery and is in turn used for password recovery by every other website.
  - lotsofpulp 8y ago
    Gmail allows you to use SMS, but does not force you to and gives you other secure options.
    - ahelwer 8y ago
      That's true, but I single it out because: 1) Many people have had their Gmail account for a long time, starting before SMS-based 2FA was widely known as a security disaster (this is in fact still not widely-known) 2) Google still actively encourages users to add a recovery phone number 3) Users could have added a phone number years ago then forgotten (this was the case with myself) 4) Users often have many websites using their Gmail account for password-reset workflows (this is definitely the case with myself) All of these combine to make Gmail the ideal hacker entrypoint. See this hack: https://www.reddit.com/r/ethtrader/comments/8klw4f/someone_just_stoke_over_150k_in_crypto_from_me/ https://www.reddit.com/r/ethtrader/comments/8klw4f/someone_j...
      - gruez 8y ago
        >2) Google still actively encourages users to add a recovery phone number i would consider the average person to be pretty bad at handling otp backups. how else would you do recovery?
        ahelwer 8y ago
        You are correct this is a significant usability issue. Personally I use Authy, which performs automatic encrypted backups in case I lose my phone. I then have to remember my Authy recovery password (not stored in my password manager, which is itself secured with a TOTP - hello circular dependency danger!) I also keep a yubikey authorized with all my accounts as second backup. All these things are beyond what the average person wants to worry about, as you say, but HN readers will find it simple. Personally I'm hoping U2F (Yubikeys) are the future, since your average person certainly understands the concept of a key.
kevin_nisbet 8y ago
Actually I think TD just launched a SMS based two factor, I set it up on the weekend (I got prompted when I logged into EasyWeb, and it's also in my security settings). It's SMS based, and can be configured on how aggressive it is (when you change IP/computer, or every time you log in). I would much prefer to see a second factor like TOTP, U2F, etc as the problems with SMS based second factor are well documented, but I'll take what I can get.
- verelo 8y ago
  Correct! Thanks for posting this, i just enabled it. For anyone who wants to set it up you can find it by... 1) Logging into Easy Web 2) Click your name in the top right 3) "Password and security"
  - ahelwer 8y ago
    SMS-based 2FA is less secure than just a password. You unfortunately decreased the security of your account :(
    - kevin_nisbet 8y ago
      Can you elaborate? I'm not sure I understand why you believe SMS codes as a second factor compromise the security of the password authentication.
      - derefr 8y ago
        It’s very easy to socially engineer a cellular ISP into redirecting arbitrary customers’ calls/texts to you, with just publically-available information.
        A2017U1 8y ago
        That only matters if account reset is done through SMS. Barring that it is another layer of protection albeit weaker than TOTP.
soperj 8y ago
TD is actually terrible. If you forget your password and you can answer one of the questions about the person (Ie: what was your high school mascot?) they actually just let you change the password at that point.
Pxtl 8y ago
Hah, I remember when TD actually started supporting proper password lengths and published a bunch of fluff pieces about good password practices, as if none of their users remember their old short password restrictions.
mabbo 8y ago
> one of the local credit unions in Toronto Got a name? And do you recommend them? Long-time RBC customer, which means they treat me terribly. Mortgage is coming up for renewal soon enough.
- verelo 8y ago
  I signed up for both Meridian and EQ bank. Both supported various 2FA options. I only used them as a higher interest savings account (One was 1.5% the other was 2%, so yeah, low but not terrible - I've since moved that tax liability to Wealthsimple's high interest account), cannot really vouch for their service outside of saying they gave me the interest and the initial capital back without any drama.

by verelo 8y ago

ams6110 8y ago

SMS as a 2FA has been discredited, but I suppose it's better than nothing.

ahelwer 8y ago
Nope, it's worse. Websites will use it as an authentication method in password-reset workflows, which means hacking your account reduces to intercepting or redirecting text messages (easily accomplished). Rampant cryptocurrency theft over the past year has conclusively demonstrated that SMS-based 2FA is worse than no 2FA at all. The worst offender? Gmail. It uses your phone number for password recovery and is in turn used for password recovery by every other website.
- lotsofpulp 8y ago
  Gmail allows you to use SMS, but does not force you to and gives you other secure options.
  - ahelwer 8y ago
    That's true, but I single it out because: 1) Many people have had their Gmail account for a long time, starting before SMS-based 2FA was widely known as a security disaster (this is in fact still not widely-known) 2) Google still actively encourages users to add a recovery phone number 3) Users could have added a phone number years ago then forgotten (this was the case with myself) 4) Users often have many websites using their Gmail account for password-reset workflows (this is definitely the case with myself) All of these combine to make Gmail the ideal hacker entrypoint. See this hack: https://www.reddit.com/r/ethtrader/comments/8klw4f/someone_just_stoke_over_150k_in_crypto_from_me/ https://www.reddit.com/r/ethtrader/comments/8klw4f/someone_j...
    - gruez 8y ago
      >2) Google still actively encourages users to add a recovery phone number i would consider the average person to be pretty bad at handling otp backups. how else would you do recovery?
      - ahelwer 8y ago
        You are correct this is a significant usability issue. Personally I use Authy, which performs automatic encrypted backups in case I lose my phone. I then have to remember my Authy recovery password (not stored in my password manager, which is itself secured with a TOTP - hello circular dependency danger!) I also keep a yubikey authorized with all my accounts as second backup. All these things are beyond what the average person wants to worry about, as you say, but HN readers will find it simple. Personally I'm hoping U2F (Yubikeys) are the future, since your average person certainly understands the concept of a key.

kevin_nisbet 8y ago

Actually I think TD just launched a SMS based two factor, I set it up on the weekend (I got prompted when I logged into EasyWeb, and it's also in my security settings). It's SMS based, and can be configured on how aggressive it is (when you change IP/computer, or every time you log in). I would much prefer to see a second factor like TOTP, U2F, etc as the problems with SMS based second factor are well documented, but I'll take what I can get.

verelo 8y ago
Correct! Thanks for posting this, i just enabled it. For anyone who wants to set it up you can find it by... 1) Logging into Easy Web 2) Click your name in the top right 3) "Password and security"
- ahelwer 8y ago
  SMS-based 2FA is less secure than just a password. You unfortunately decreased the security of your account :(
  - kevin_nisbet 8y ago
    Can you elaborate? I'm not sure I understand why you believe SMS codes as a second factor compromise the security of the password authentication.
    - derefr 8y ago
      It’s very easy to socially engineer a cellular ISP into redirecting arbitrary customers’ calls/texts to you, with just publically-available information.
      - A2017U1 8y ago
        That only matters if account reset is done through SMS. Barring that it is another layer of protection albeit weaker than TOTP.

soperj 8y ago

TD is actually terrible. If you forget your password and you can answer one of the questions about the person (Ie: what was your high school mascot?) they actually just let you change the password at that point.

Pxtl 8y ago

Hah, I remember when TD actually started supporting proper password lengths and published a bunch of fluff pieces about good password practices, as if none of their users remember their old short password restrictions.

mabbo 8y ago

> one of the local credit unions in Toronto Got a name? And do you recommend them? Long-time RBC customer, which means they treat me terribly. Mortgage is coming up for renewal soon enough.

verelo 8y ago
I signed up for both Meridian and EQ bank. Both supported various 2FA options. I only used them as a higher interest savings account (One was 1.5% the other was 2%, so yeah, low but not terrible - I've since moved that tax liability to Wealthsimple's high interest account), cannot really vouch for their service outside of saying they gave me the interest and the initial capital back without any drama.