3 ms·

I keep telling my bank SMS 2fa is bad but they say it is not. Many banks replaced tokens with SMS unfortunately.

by tluyben2 8y ago

21 8y ago
Your average mom & pop can't handle TOTP 2FA, they will inevitably need to reset it when changing phones.
- adrr 8y ago
  FOB based token generator that you can attach to your keys is pretty braindead. Some banks used to issue them but have switched to SMS/EMail.
  - reitanqild 8y ago
    Around here it is still mandatory, that or something on the SIM card of the phone that 1) displays a popup that you can match with the bank login screen and then 2) type a separate pin code on your phone to unlock.
adrr 8y ago
I don't know any bank that supports token-based 2FA and most support both SMS and email based 2FA. Email is a terrible 2FA method since most users re-use passwords. One way to help protect you is to visit your carrier's retail store and have them turn off online access to your account and require all changes to your account to be done in person with a valid government ID. This should make it more difficult for number porting attacks but they can still sniff the SMS message when goes over the cell network. As far as I know, mobile network control messages aren't protected.
- Symbiote 8y ago
  Several British banks use Chip+PIN cards to provide a token — not necessarily for login, but for authorizing a transaction. Like this: https://c7.alamy.com/comp/CYGATP/online-banking-security-chip-and-pin-card-reader-for-authorising-transactions-CYGATP.jpg https://c7.alamy.com/comp/CYGATP/online-banking-security-chi...
- dboreham 8y ago
  >I don't know any bank that supports token-based 2FA Wells Fargo supports RSA SecurID tokens. Source : I have one. However, they also support SMS as an alternative. I'm not sure if SMS can be disabled..
- tluyben2 8y ago
  I have several hardware tokens for banks; the one of the Rabobank is as big and heavy as some phones :/ It has a camera and color screen built in. Secure but jikes I don't want to drag it around. The rest all do SMS only; I have never heard of 2fa via email; that sounds like the worst idea ever.
konraditurbe 8y ago
If you're using PayPal, they support proprietary one time key and SMS, a guy came up with a method to use any 2FA app with paypal: https://medium.com/@dubistkomisch/set-up-2fa-two-factor-authentication-for-paypal-with-google-authenticator-or-other-totp-client-60fee63bfa4f https://medium.com/@dubistkomisch/set-up-2fa-two-factor-auth... Just tried it myself, it works.

I keep telling my bank SMS 2fa is bad but they say it is not. Many banks replaced tokens with SMS unfortunately.

21 8y ago

Your average mom & pop can't handle TOTP 2FA, they will inevitably need to reset it when changing phones.

adrr 8y ago
FOB based token generator that you can attach to your keys is pretty braindead. Some banks used to issue them but have switched to SMS/EMail.
- reitanqild 8y ago
  Around here it is still mandatory, that or something on the SIM card of the phone that 1) displays a popup that you can match with the bank login screen and then 2) type a separate pin code on your phone to unlock.

adrr 8y ago

I don't know any bank that supports token-based 2FA and most support both SMS and email based 2FA. Email is a terrible 2FA method since most users re-use passwords. One way to help protect you is to visit your carrier's retail store and have them turn off online access to your account and require all changes to your account to be done in person with a valid government ID. This should make it more difficult for number porting attacks but they can still sniff the SMS message when goes over the cell network. As far as I know, mobile network control messages aren't protected.

Symbiote 8y ago
Several British banks use Chip+PIN cards to provide a token — not necessarily for login, but for authorizing a transaction. Like this: https://c7.alamy.com/comp/CYGATP/online-banking-security-chip-and-pin-card-reader-for-authorising-transactions-CYGATP.jpg https://c7.alamy.com/comp/CYGATP/online-banking-security-chi...
dboreham 8y ago
>I don't know any bank that supports token-based 2FA Wells Fargo supports RSA SecurID tokens. Source : I have one. However, they also support SMS as an alternative. I'm not sure if SMS can be disabled..
tluyben2 8y ago
I have several hardware tokens for banks; the one of the Rabobank is as big and heavy as some phones :/ It has a camera and color screen built in. Secure but jikes I don't want to drag it around. The rest all do SMS only; I have never heard of 2fa via email; that sounds like the worst idea ever.

konraditurbe 8y ago

If you're using PayPal, they support proprietary one time key and SMS, a guy came up with a method to use any 2FA app with paypal: https://medium.com/@dubistkomisch/set-up-2fa-two-factor-authentication-for-paypal-with-google-authenticator-or-other-totp-client-60fee63bfa4f https://medium.com/@dubistkomisch/set-up-2fa-two-factor-auth... Just tried it myself, it works.