3 ms·
And this is just another reason why SMS based 2FA is fundamentally broken. I bank with Barclays in the UK and they give each of their account holders a PinSent
by philjohn 8y ago
And this is just another reason why SMS based 2FA is fundamentally broken.
I bank with Barclays in the UK and they give each of their account holders a PinSentry device. This is a physical device that you have to insert your card into, and then enter your pin code to unlock, you then use it to sign/verify transactions that you are trying to make.
Don't have access to the pin sentry device? Guess who can't add a new transfer recipient.
- cravespotato 8y agoBarclays is a terrible example. If someone obtain your pin and nick your card then can do anything with your bank account as the card works with any pinsentry. Much better is HSBC. The device you get is the only one that works, you cannot use different device.
- mdekkers 8y agoIf someone obtain your pin and nick your card If that is the case there are many options available to you that do not require pinsentry. This argument makes no sense in the context of this discussion.
- cravespotato 8y agoIt does because I just demonstrated Barclays way is less secure. Like it or not.
- handzbagz 8y agoThe chink in the chain for Barclays though is their mobile app on-boarding that relies on bank account information and SMS authentication which turns your phone into a PinSentry too. Don't get me wrong, Barclays probably does it better than anyone else but I was surprised when I set up a new phone recently.
- philjohn 8y agoThat's odd - when I installed the iOS app I either had to get a one-time-code by using a Barclays ATM, or by identifying with my physical PinSentry device ...