7 ms·

Actually I think TD just launched a SMS based two factor, I set it up on the weekend (I got prompted when I logged into EasyWeb, and it's also in my security se

Actually I think TD just launched a SMS based two factor, I set it up on the weekend (I got prompted when I logged into EasyWeb, and it's also in my security settings). It's SMS based, and can be configured on how aggressive it is (when you change IP/computer, or every time you log in). I would much prefer to see a second factor like TOTP, U2F, etc as the problems with SMS based second factor are well documented, but I'll take what I can get.

verelo 8y ago
Correct! Thanks for posting this, i just enabled it. For anyone who wants to set it up you can find it by... 1) Logging into Easy Web 2) Click your name in the top right 3) "Password and security"
- ahelwer 8y ago
  SMS-based 2FA is less secure than just a password. You unfortunately decreased the security of your account :(
  - kevin_nisbet 8y ago
    Can you elaborate? I'm not sure I understand why you believe SMS codes as a second factor compromise the security of the password authentication.
    - derefr 8y ago
      It’s very easy to socially engineer a cellular ISP into redirecting arbitrary customers’ calls/texts to you, with just publically-available information.
      - A2017U1 8y ago
        That only matters if account reset is done through SMS. Barring that it is another layer of protection albeit weaker than TOTP.
        derefr 8y ago
        Usually if you have a given user's username and password (from some big accounts breach), but not 2FA SMS access, you can still access enough accounts of theirs (because people still tend to use the same password for everything!) to see all the personal details required to phish the 2FA SMS redirection out of their cellular ISP. Or, sometimes, you don't even need login access; one notable attack has been to the credit-reporting systems, where to unfreeze your credit report (and thereby apply for new credit lines) the reporting agencies require your name, birthdate, SSN, and SMS verification. But if the attacker already has name, birthdate, and SSN... well, that's all they need to get the cellular ISP to redirect the SMS verification, as well.
  - Rafert 8y ago
    How is requiring a SMS token in addition to a password less secure than just requiring the password?
    - ahelwer 8y ago
      Because SMS is used in password-recovery workflows, meaning it isn't a second factor at all - it's a single, easily-breakable factor.
      - jeromegv 8y ago
        Except your bank already has your phone number. If phone was already part of the recovery process, it didn’t make it any less safe by enabling 2FA SMS
      - kevin_nisbet 8y ago
        This only happens if SMS get's used in the password-recovery workflow. I don't think there is evidence that TD is using SMS to replace password reset. So I really don't see how this makes security worse.
  - deleted 8y ago
    [deleted]
  - verelo 8y ago
    Maybe, that depends on the implementation. I don't believe they allow password resets from Easyweb via SMS, so i believe in this case it's at worst "as good as it was before", and only when they've managed to hijack my phone number.
deleted 8y ago
[deleted]
ar0 8y ago
Even TOTP is not a good 2fa system for a bank login, at least if that account allows you to send money somewhere: TOTP codes do not differentiate by transaction type, so if a fraudster has taken over your computer, it can wait for you to login using TOTP and then send a wire transfer in the background (using the same TOTP quickly enough if necessary or just asking you to log in again, pretending your first code was wrong). That’s why proper banks should use 2FA mechanisms that will ask the user to confirm the transaction on a second device (e.g. photoTAN or similar). Of course, this won’t help against attacks if both devices are compromised or you are using the second factor device to access the system, but it’s still better than TOTP. And, of course, TOTP is still way better than SMS 2FA or no 2FA.
- _hl_ 8y ago
  If someone has hijacked your computer, they could simply steal your session cookie and do whatever they want regardless of some TOTP secrets or being quick enough. In fact at that point any 2FA becomes meaningless - it's already game over. Unless of course your bank does some proper, additional verification for large volume transfers.
  - ar0 8y ago
    Of course, that‘s the point: with photoTAN et al. it will request a one-time token for each wire transfer, and the token is based on the information (amount and recipient) of the transfer, which the user needs to confirm on its 2FA device.

verelo 8y ago

Correct! Thanks for posting this, i just enabled it. For anyone who wants to set it up you can find it by... 1) Logging into Easy Web 2) Click your name in the top right 3) "Password and security"

ahelwer 8y ago
SMS-based 2FA is less secure than just a password. You unfortunately decreased the security of your account :(
- kevin_nisbet 8y ago
  Can you elaborate? I'm not sure I understand why you believe SMS codes as a second factor compromise the security of the password authentication.
  - derefr 8y ago
    It’s very easy to socially engineer a cellular ISP into redirecting arbitrary customers’ calls/texts to you, with just publically-available information.
    - A2017U1 8y ago
      That only matters if account reset is done through SMS. Barring that it is another layer of protection albeit weaker than TOTP.
      - derefr 8y ago
        Usually if you have a given user's username and password (from some big accounts breach), but not 2FA SMS access, you can still access enough accounts of theirs (because people still tend to use the same password for everything!) to see all the personal details required to phish the 2FA SMS redirection out of their cellular ISP. Or, sometimes, you don't even need login access; one notable attack has been to the credit-reporting systems, where to unfreeze your credit report (and thereby apply for new credit lines) the reporting agencies require your name, birthdate, SSN, and SMS verification. But if the attacker already has name, birthdate, and SSN... well, that's all they need to get the cellular ISP to redirect the SMS verification, as well.
- Rafert 8y ago
  How is requiring a SMS token in addition to a password less secure than just requiring the password?
  - ahelwer 8y ago
    Because SMS is used in password-recovery workflows, meaning it isn't a second factor at all - it's a single, easily-breakable factor.
    - jeromegv 8y ago
      Except your bank already has your phone number. If phone was already part of the recovery process, it didn’t make it any less safe by enabling 2FA SMS
    - kevin_nisbet 8y ago
      This only happens if SMS get's used in the password-recovery workflow. I don't think there is evidence that TD is using SMS to replace password reset. So I really don't see how this makes security worse.
- deleted 8y ago
  [deleted]
- verelo 8y ago
  Maybe, that depends on the implementation. I don't believe they allow password resets from Easyweb via SMS, so i believe in this case it's at worst "as good as it was before", and only when they've managed to hijack my phone number.

deleted 8y ago

[deleted]

ar0 8y ago

Even TOTP is not a good 2fa system for a bank login, at least if that account allows you to send money somewhere: TOTP codes do not differentiate by transaction type, so if a fraudster has taken over your computer, it can wait for you to login using TOTP and then send a wire transfer in the background (using the same TOTP quickly enough if necessary or just asking you to log in again, pretending your first code was wrong). That’s why proper banks should use 2FA mechanisms that will ask the user to confirm the transaction on a second device (e.g. photoTAN or similar). Of course, this won’t help against attacks if both devices are compromised or you are using the second factor device to access the system, but it’s still better than TOTP. And, of course, TOTP is still way better than SMS 2FA or no 2FA.

_hl_ 8y ago
If someone has hijacked your computer, they could simply steal your session cookie and do whatever they want regardless of some TOTP secrets or being quick enough. In fact at that point any 2FA becomes meaningless - it's already game over. Unless of course your bank does some proper, additional verification for large volume transfers.
- ar0 8y ago
  Of course, that‘s the point: with photoTAN et al. it will request a one-time token for each wire transfer, and the token is based on the information (amount and recipient) of the transfer, which the user needs to confirm on its 2FA device.