5 ms·

I keep getting astonished by how bad online banking security is in the UK and US. Here in scandiavia, we've had hardware tokens (or phone apps) to offer 2fa fo

by gnud 7y ago

I keep getting astonished by how bad online banking security is in the UK and US. Here in scandiavia, we've had hardware tokens (or phone apps) to offer 2fa for ages. And you need a new token for every transaction. In addition to the password for logging in. When you reset your password, you get an email and an SMS saying that your password was reset. Last time I needed a new token issuer dongle, I had to actually visit the bank and sign stuff.

highhedgehog 7y ago
This is so true. My wife (US) just needs user+pwd to access her bank. Me (Italy), had physical tokens or at least SMS 2fa for years. Also EU is now going through a major security upgrade for banks with SCA (Strong Customer Authentication)
- zmodem 7y ago
  My US bank added "two-factor" authentication at some point, requiring both a password and the answer to my secret question :-D
NeedMoreTea 7y ago
Oh it gets worse. My UK bank had a hardware token for years. They recently "upgraded" my security for online banking, and now use SMS 2FA codes for login and authorising new transfers. The hardware token is now unusable. I'd change banks, but I doubt the others are better.
- edent 7y ago
  They are better. One of my banks offer a hardware token which requires my card to be physically present and for a correct PIN to be entered. The other has an app with push notifications which can be used to approve or deny transactions. Seriously, switch bank.
  - NeedMoreTea 7y ago
    Aye, that's what they used to use. Great News! Now I don't have to remember to have my card reader and I can use app, SMS or email to get codes instead. Err WTF? Apparently these changes help protect my accounts from fraud better, or some similar Orwellian doublespeak. I did wonder if it was some unintended consequence of the EU banking interop changes, but that didn't seem especially convincing. OK, changing bank it is then. At least it's so much easier than it used to be. :)
- aclelland 7y ago
  To send money over £250, RBS still use hardware card readers for their MFA flow. You put your debit/credit card in the device, entry your normal pin and then a code that is displayed on the website. It's a little inconvenient of you don't have the device with you when you need to send large amounts of money but in general it's great to have rather than SMS. Of course, I expect that eventually they'll move to SMS too since it's easier for them and more on line with the rest of the industry.
  - imtringued 7y ago
    Under the new EU rules 2FA over SMS is not allowed because it is possible to transfer phone numbers to other devices (through social engineering or simply because providers reuse old numbers) and thereby intercept the code. Instead most banks use an authentication app so that 2FA is bound to a single device.
    - jwilk 7y ago
      Citation needed? Some Polish banks definitely allow using SMS as a second-factor. (And some even let you use a permanent cookie for that. :-O)
- SmellyGeekBoy 7y ago
  HSBC did this to me as well. The battery had died in my old token so I had to jump through so many hoops as the default assumption seemed to be that the customer would have a working token to set up the 2FA.
- tomp 7y ago
  I hate hardware tokens. Recently got one from my bank. I'm switching banks. I just don't see any advantage over a phone app (plus a phone app can offer better notifications).
  - NeedMoreTea 7y ago
    Yes, but then it's not 2FA, it's notifications in the app you're probably using for banking, so now it's 1FA. That's fine for sending £100 to an account already in your list of payees, but to set up a new account, where's the second factor in an app? That, to me, seems a large step backwards.
    - tomp 7y ago
      Well, you need (1) my phone and (2) my fingerprint, so technically it is 2FA. They could easily require (1) my password and (2) my phone, so still 2FA. 2FA is usually fake anyways, there's usually a way to reset stuff with only one factor (e.g. use phone number to reset password, or login with password and change phone number, ... same with PIN), so it's all a misnomer anyways.
laurent123456 7y ago
> Last time I needed a new token issuer dongle, I had to actually visit the bank and sign stuff. I'm glad UK banks try to avoid physical dongles because having to go to the bank and sign stuff to get one is not always convenient, not to mention you need to carry around the dongle everywhere, and if you lose it while you're in vacation it's yet more troubles. Phone 2FA would be good but a bit pointless because the 2FA app is on the phone, and so is the banking app. Personally I'm satisfied with the way UK banks handle security - it's secure, they block suspicious transactions, etc. yet it doesn't get too much in your way. I don't think UK banks are less competent, it's just a fine balance between usability and security.
- highhedgehog 7y ago
  > Phone 2FA would be good but a bit pointless because the 2FA app is on the phone, and so is the banking app. This is exactly like having a physical token with you. If it gets stolen, they have the tokens. But, at least, having token on the phone app is waymore convenient for customers and also has another layer of protection (think of the fingerprint/passcode ecc you need to access your phone)
  - eCa 7y ago
    Over here in EU land the mobile identifier app is pin protected. Think Google Authenticator but with a pin to access the tokens. You need my phone unlocked and my six digit pin in order to identify as me. There are still possible social engineering attacks, though.
    - highhedgehog 7y ago
      Yes, I actually am in EU land myself, and I forgot about that
- gnud 7y ago
  The phone 2fa app asks you to verify the action, and you input your PIN. My banks hardware token also needs a PIN before it generates a one-time code. Some bank tokens just give you the code when you press a button, though. Those, you have to worry if stolen.
navidfarhadi 7y ago
As a child in Sweden in the late 90s and early 2000s I recall that my dad had a hardware token to access his bank account. Though nowadays people in Sweden use BankID for the most part which is 2FA in the form of a mobile app. BankID is also used to login to most government websites in Sweden which is nice. Meanwhile, banking security in the US is stuck in the Stone Age. Last I checked Wells Fargo, one of the largest US banks, still does not allow passwords greater than 14 characters in length and passwords are not case sensitive.
tmikaeld 7y ago
In Sweden we have BankID - a two-factor, two-way authentication using public/private encrypted keys that's bound to a smartphone as a signature. The process is user-friendly while keeping security high: - The place where you want to login has to trigger the authentication from their server on every login - and have to be certified for BankID. - You then have to open the app, enter your fingerprint or 6-pin code before you can enter. It's available for all state-run services including all banks and post offices.
- emilfihlman 7y ago
  >that's bound to a smartphone as a signature. Big yikes, that's a no for me.
  - gnud 7y ago
    This is the same system I'm talking about. You can use your smartphone and a PIN, or you can get a hardware dongle. Same authentication API from the banks POV.
    - emilfihlman 7y ago
      OP (a big bank in Finland) is not offering a hardware dongle and I'm considering changing banks because of it.
- draugadrotten 7y ago
  Unfortunately the BankID has been scammed a lot, where fraudsters have simple asked people on the phone to sign BankID stuff for them. It is far from perfect and in fact the scam here would be possible to do with BankID as well. https://www.expressen.se/dinapengar/sparande/bedragerier-med-bank-id-okar-sa-har-skyddar-du-dig/ https://www.expressen.se/dinapengar/sparande/bedragerier-med...
  - tmikaeld 7y ago
    Sure, I'd assume that social engineering will always work as long as a person has no way to validate who's on the other end.
imtringued 7y ago
The EU has made 2FA mandatory for online banking as of September.
OJFord 7y ago
I had one of those from a major UK bank nearly 15 years ago.
deleted 7y ago
[deleted]
systemtest 7y ago
In the Netherlands we used to have dongles or card-readers for all online banking but we are now downgrading to apps, 5-digit number codes and 2FA without an external device. This is all for ease of use but I think from a security standpoint it's not the right direction to go. For instance, in an app you can't view the certificate and wether or not the connection is secure. If you are in a foreign country with dubious leadership it could be hijacked using a rogue SIM-card or some dictator driven root CA (looking at you Kazakhstan). The worst offender is ING, you can set a payment limit in the app but then you can also change the payment limit in the app itself. If I take a nap on the train, you can drain my bank account my pressing my thumb on the reader.

by gnud 7y ago

highhedgehog 7y ago

This is so true. My wife (US) just needs user+pwd to access her bank. Me (Italy), had physical tokens or at least SMS 2fa for years. Also EU is now going through a major security upgrade for banks with SCA (Strong Customer Authentication)

zmodem 7y ago
My US bank added "two-factor" authentication at some point, requiring both a password and the answer to my secret question :-D

NeedMoreTea 7y ago

Oh it gets worse. My UK bank had a hardware token for years. They recently "upgraded" my security for online banking, and now use SMS 2FA codes for login and authorising new transfers. The hardware token is now unusable. I'd change banks, but I doubt the others are better.

edent 7y ago
They are better. One of my banks offer a hardware token which requires my card to be physically present and for a correct PIN to be entered. The other has an app with push notifications which can be used to approve or deny transactions. Seriously, switch bank.
- NeedMoreTea 7y ago
  Aye, that's what they used to use. Great News! Now I don't have to remember to have my card reader and I can use app, SMS or email to get codes instead. Err WTF? Apparently these changes help protect my accounts from fraud better, or some similar Orwellian doublespeak. I did wonder if it was some unintended consequence of the EU banking interop changes, but that didn't seem especially convincing. OK, changing bank it is then. At least it's so much easier than it used to be. :)
aclelland 7y ago
To send money over £250, RBS still use hardware card readers for their MFA flow. You put your debit/credit card in the device, entry your normal pin and then a code that is displayed on the website. It's a little inconvenient of you don't have the device with you when you need to send large amounts of money but in general it's great to have rather than SMS. Of course, I expect that eventually they'll move to SMS too since it's easier for them and more on line with the rest of the industry.
- imtringued 7y ago
  Under the new EU rules 2FA over SMS is not allowed because it is possible to transfer phone numbers to other devices (through social engineering or simply because providers reuse old numbers) and thereby intercept the code. Instead most banks use an authentication app so that 2FA is bound to a single device.
  - jwilk 7y ago
    Citation needed? Some Polish banks definitely allow using SMS as a second-factor. (And some even let you use a permanent cookie for that. :-O)
SmellyGeekBoy 7y ago
HSBC did this to me as well. The battery had died in my old token so I had to jump through so many hoops as the default assumption seemed to be that the customer would have a working token to set up the 2FA.
tomp 7y ago
I hate hardware tokens. Recently got one from my bank. I'm switching banks. I just don't see any advantage over a phone app (plus a phone app can offer better notifications).
- NeedMoreTea 7y ago
  Yes, but then it's not 2FA, it's notifications in the app you're probably using for banking, so now it's 1FA. That's fine for sending £100 to an account already in your list of payees, but to set up a new account, where's the second factor in an app? That, to me, seems a large step backwards.
  - tomp 7y ago
    Well, you need (1) my phone and (2) my fingerprint, so technically it is 2FA. They could easily require (1) my password and (2) my phone, so still 2FA. 2FA is usually fake anyways, there's usually a way to reset stuff with only one factor (e.g. use phone number to reset password, or login with password and change phone number, ... same with PIN), so it's all a misnomer anyways.

laurent123456 7y ago

> Last time I needed a new token issuer dongle, I had to actually visit the bank and sign stuff. I'm glad UK banks try to avoid physical dongles because having to go to the bank and sign stuff to get one is not always convenient, not to mention you need to carry around the dongle everywhere, and if you lose it while you're in vacation it's yet more troubles. Phone 2FA would be good but a bit pointless because the 2FA app is on the phone, and so is the banking app. Personally I'm satisfied with the way UK banks handle security - it's secure, they block suspicious transactions, etc. yet it doesn't get too much in your way. I don't think UK banks are less competent, it's just a fine balance between usability and security.

highhedgehog 7y ago
> Phone 2FA would be good but a bit pointless because the 2FA app is on the phone, and so is the banking app. This is exactly like having a physical token with you. If it gets stolen, they have the tokens. But, at least, having token on the phone app is waymore convenient for customers and also has another layer of protection (think of the fingerprint/passcode ecc you need to access your phone)
- eCa 7y ago
  Over here in EU land the mobile identifier app is pin protected. Think Google Authenticator but with a pin to access the tokens. You need my phone unlocked and my six digit pin in order to identify as me. There are still possible social engineering attacks, though.
  - highhedgehog 7y ago
    Yes, I actually am in EU land myself, and I forgot about that
gnud 7y ago
The phone 2fa app asks you to verify the action, and you input your PIN. My banks hardware token also needs a PIN before it generates a one-time code. Some bank tokens just give you the code when you press a button, though. Those, you have to worry if stolen.

navidfarhadi 7y ago

As a child in Sweden in the late 90s and early 2000s I recall that my dad had a hardware token to access his bank account. Though nowadays people in Sweden use BankID for the most part which is 2FA in the form of a mobile app. BankID is also used to login to most government websites in Sweden which is nice. Meanwhile, banking security in the US is stuck in the Stone Age. Last I checked Wells Fargo, one of the largest US banks, still does not allow passwords greater than 14 characters in length and passwords are not case sensitive.

tmikaeld 7y ago

In Sweden we have BankID - a two-factor, two-way authentication using public/private encrypted keys that's bound to a smartphone as a signature. The process is user-friendly while keeping security high: - The place where you want to login has to trigger the authentication from their server on every login - and have to be certified for BankID. - You then have to open the app, enter your fingerprint or 6-pin code before you can enter. It's available for all state-run services including all banks and post offices.

emilfihlman 7y ago
>that's bound to a smartphone as a signature. Big yikes, that's a no for me.
- gnud 7y ago
  This is the same system I'm talking about. You can use your smartphone and a PIN, or you can get a hardware dongle. Same authentication API from the banks POV.
  - emilfihlman 7y ago
    OP (a big bank in Finland) is not offering a hardware dongle and I'm considering changing banks because of it.
draugadrotten 7y ago
Unfortunately the BankID has been scammed a lot, where fraudsters have simple asked people on the phone to sign BankID stuff for them. It is far from perfect and in fact the scam here would be possible to do with BankID as well. https://www.expressen.se/dinapengar/sparande/bedragerier-med-bank-id-okar-sa-har-skyddar-du-dig/ https://www.expressen.se/dinapengar/sparande/bedragerier-med...
- tmikaeld 7y ago
  Sure, I'd assume that social engineering will always work as long as a person has no way to validate who's on the other end.

imtringued 7y ago

The EU has made 2FA mandatory for online banking as of September.

OJFord 7y ago

I had one of those from a major UK bank nearly 15 years ago.

deleted 7y ago

[deleted]

systemtest 7y ago

In the Netherlands we used to have dongles or card-readers for all online banking but we are now downgrading to apps, 5-digit number codes and 2FA without an external device. This is all for ease of use but I think from a security standpoint it's not the right direction to go. For instance, in an app you can't view the certificate and wether or not the connection is secure. If you are in a foreign country with dubious leadership it could be hijacked using a rogue SIM-card or some dictator driven root CA (looking at you Kazakhstan). The worst offender is ING, you can set a payment limit in the app but then you can also change the payment limit in the app itself. If I take a nap on the train, you can drain my bank account my pressing my thumb on the reader.