4 ms·

Then why there is no law for 2FA in the banks? In Turkey all banks must provide 2FA for logins. It is required by law.

dredmorbius 7y ago
Krebs has covered this previously; oligopoly service providers. See his excellent, if depressing, 2018 exploration of banking security, "What Is Your Bank’s Security Banking On?".[1] Sadly, the industry is dominated by a small handful of banking platform providers. Four, Fiserv, Jack Henry, FIS, and CSI, serv over 80% of the market. Bank regulators, responding to Krebs, said that "small to mid-sized banks are massively beholden to their platform providers, and many banks simply accept the defaults instead of pushing for stronger alternatives." This is not a good situation. Digging further into the matter, I turned up a set of publications by Experian -- the credit rating agency which hasn't been breached ... yet -- on risk and fraud, including credential compromise.[2] One of these mentions in. passing that the typical person has "about 100" service-based accounts.[3] That's not all that far off the count of 700 accounts HN users have reported having.[4] ________________________________ Notes: 1. https://krebsonsecurity.com/2018/03/what-is-your-banks-security-banking-on/ https://krebsonsecurity.com/2018/03/what-is-your-banks-secur... (HN: https://news.ycombinator.com/item?id=20203482 https://news.ycombinator.com/item?id=20203482) 2. Stealthily hidden around Experian's website, though this search presently lists several of the beter ones: https://www.experian.com/innovation/thought-leadership/fraud.. https://www.experian.com/innovation/thought-leadership/fraud.... (https://web.archive.org/web/*/https://www.experian.com/innov... https://web.archive.org/web/*/https://www.experian.com/innov...) 3. "Upcoming fraud trends and how to combat them: Ebook" https://www.experian.com/innovation/thought-leadership/upcom.. https://www.experian.com/innovation/thought-leadership/upcom.... 4. packet_nerd reports that here, though I recall an earlier mention as well: https://news.ycombinator.com/item?id=19488899 https://news.ycombinator.com/item?id=19488899
mikestew 7y ago
There at least used to be in the U. S. (Haven't worked in that space in ten years, and haven't kept up.) Worked on a 2FA system just as such a law was going into place (too lazy to look it up; call me on it, and I'll take the five minutes.) Woo hoo, do I want to go Ferrari or Lambo? Banks are going to have to use something, and ours is hardware-free and works on any browser. "Wait a minute...what? Match-the-picture and security questions are going to count as '2FA'?! Are you fucking kidding me?" I still work for a living, and drive something Japanese, not Italian. I have no idea what current status is in the U. S.
mqus 7y ago
look up PSD2, which is an EU directive with the same objective, coming into effect in september this year. But I'm not entirely sure if 2fa is also necessary for login and not only for transactions.

Krebs has covered this previously; oligopoly service providers. See his excellent, if depressing, 2018 exploration of banking security, "What Is Your Bank’s Security Banking On?".[1] Sadly, the industry is dominated by a small handful of banking platform providers. Four, Fiserv, Jack Henry, FIS, and CSI, serv over 80% of the market. Bank regulators, responding to Krebs, said that "small to mid-sized banks are massively beholden to their platform providers, and many banks simply accept the defaults instead of pushing for stronger alternatives." This is not a good situation. Digging further into the matter, I turned up a set of publications by Experian -- the credit rating agency which hasn't been breached ... yet -- on risk and fraud, including credential compromise.[2] One of these mentions in. passing that the typical person has "about 100" service-based accounts.[3] That's not all that far off the count of 700 accounts HN users have reported having.[4] ________________________________ Notes: 1. https://krebsonsecurity.com/2018/03/what-is-your-banks-security-banking-on/ https://krebsonsecurity.com/2018/03/what-is-your-banks-secur... (HN: https://news.ycombinator.com/item?id=20203482 https://news.ycombinator.com/item?id=20203482) 2. Stealthily hidden around Experian's website, though this search presently lists several of the beter ones: https://www.experian.com/innovation/thought-leadership/fraud.. https://www.experian.com/innovation/thought-leadership/fraud.... (https://web.archive.org/web/*/https://www.experian.com/innov... https://web.archive.org/web/*/https://www.experian.com/innov...) 3. "Upcoming fraud trends and how to combat them: Ebook" https://www.experian.com/innovation/thought-leadership/upcom.. https://www.experian.com/innovation/thought-leadership/upcom.... 4. packet_nerd reports that here, though I recall an earlier mention as well: https://news.ycombinator.com/item?id=19488899 https://news.ycombinator.com/item?id=19488899

mikestew 7y ago

There at least used to be in the U. S. (Haven't worked in that space in ten years, and haven't kept up.) Worked on a 2FA system just as such a law was going into place (too lazy to look it up; call me on it, and I'll take the five minutes.) Woo hoo, do I want to go Ferrari or Lambo? Banks are going to have to use something, and ours is hardware-free and works on any browser. "Wait a minute...what? Match-the-picture and security questions are going to count as '2FA'?! Are you fucking kidding me?" I still work for a living, and drive something Japanese, not Italian. I have no idea what current status is in the U. S.

mqus 7y ago

look up PSD2, which is an EU directive with the same objective, coming into effect in september this year. But I'm not entirely sure if 2fa is also necessary for login and not only for transactions.