5 ms·

I don't understand why there are still banks that do SMS verification. It has been proven so many times now that that it is vulnerable to both phishing (proven

by LeonM 7y ago

I don't understand why there are still banks that do SMS verification. It has been proven so many times now that that it is vulnerable to both phishing (proven here), sim swapping attacks, etc. The banks here in the Netherland all have (well, except for one maybe) hardware authentication devices. They are portable smartcard readers, you insert your card, enter your PIN on the device itself (not your computer or phone) and transfer a digest from your PC to the reader by typing or scanning a QR code (some readers have a little camera). You then type the signature into your computer or phone. The readers for my bank even have a screen, that tells you what you are signing, like a login, or transfer of which amount to which bank account. Photo here [0]. The banks are very clear that they will never ask you to use the device over the phone. And that double confirmation by showing the sign action on the screen of the reader makes any form of phishing really hard. IMO these smart card readers are the best compromise between convenience and security for banking. [0] https://4.bp.blogspot.com/-6c1NGHew1P8/VBqvTeqDQdI/AAAAAAAAfZs/j65cjnqU6-0/s1600/649931.jpg https://4.bp.blogspot.com/-6c1NGHew1P8/VBqvTeqDQdI/AAAAAAAAf...

M4v3R 7y ago
In my bank (Poland here) they have a mobile app which receives push notifications instead of SMS messages. The notification also contains the reason for the code. So in OP's case it would say "Code for resetting your account password", which would probably trigger a red flag sooner.
tom_mellior 7y ago
Not disagreeing with you in general, but: > The readers for my bank even have a screen, that tells you what you are signing, like a login, or transfer of which amount to which bank account. That's information that could and should also be included in the SMS. The OP's bank did not do this, which is a huge fail on their part.
tomp 7y ago
IMO smart card readers are the worst solution for everything. They are invariable less capable and less secure than my phone. Why would I carry 2 devices (one of these quite primitive) if I could only carry one?
- LeonM 7y ago
  Can you elaborate why you believe smartcards are less secure than your mobile phone?
  - tomp 7y ago
    All the ones I've seen have no security, either it's just a changing password (e.g. RSA key), or you input your card (optionally entering your PIN which you share with every POS terminal / shop) and get a password. My phone requires a password (which I can set to be arbitrarily secure, not 4-digit PIN (LOL)) or a fingerprint (which is something noone can steal, unlike a credit card... or at least I'd notice it's missing much sooner!)
    - tialaramex 7y ago
      RSA SecurID is not a smartcard. It's basically equivalent to TOTP except as a physical object rather than a phone app. There's secret baked into the SecurID and the issuer knows that secret so they can use it to generate the same one time code. You seem to imagine that your phone, on which you run most likely not only a wild variety of apps from potentially untrustworthy sources, but also a web browser, which is a huge attack surface facing the Internet, is more secure than a simple smart card and that doesn't make a whole lot of sense. In both cases the main real world security is that bad guys will probably need to _steal them_ which is difficult and a completely different skillset from the skills to make phishing emails or lie on the phone. But the phone is a bit worse here because maybe they can attack that remotely via, as I mentioned, your web browser, instant messaging stack or other components of a very complicated device.
    - LeonM 7y ago
      As I expected: you don't appear have a clue on what a smartcard actually is. > My phone requires a password (which I can set to be arbitrarily secure, not 4-digit PIN (LOL)) or a fingerprint (which is something noone can steal, unlike a credit card... or at least I'd notice it's missing much sooner!) Anyone can steal your fingerprint, and you can't reset your fingerprint like you can with a password or PIN. A smartcard will self-destruct (wipe the key material) after a number of unsuccessful PIN entries, so the chance of someone successfully guessing the PIN is ~1:3333 for a 4 digit PIN with 3 attempts. This is good enough for banks to offer fraud insurance, in the off-chance that your card gets cracked your bank will reimburse the damage. > optionally entering your PIN which you share with every POS terminal / shop) and get a password. Yes, but that would still require physical access to your card. So they'll need to have both your card and your PIN. At that point you'll need to have your card/account blocked ASAP anyway. Your bank will supply you with a new card and PIN, which is a way better solution compared to cutting off your fingers and attaching new ones ;-)

by LeonM 7y ago

M4v3R 7y ago

In my bank (Poland here) they have a mobile app which receives push notifications instead of SMS messages. The notification also contains the reason for the code. So in OP's case it would say "Code for resetting your account password", which would probably trigger a red flag sooner.

tom_mellior 7y ago

Not disagreeing with you in general, but: > The readers for my bank even have a screen, that tells you what you are signing, like a login, or transfer of which amount to which bank account. That's information that could and should also be included in the SMS. The OP's bank did not do this, which is a huge fail on their part.

tomp 7y ago

IMO smart card readers are the worst solution for everything. They are invariable less capable and less secure than my phone. Why would I carry 2 devices (one of these quite primitive) if I could only carry one?

LeonM 7y ago
Can you elaborate why you believe smartcards are less secure than your mobile phone?
- tomp 7y ago
  All the ones I've seen have no security, either it's just a changing password (e.g. RSA key), or you input your card (optionally entering your PIN which you share with every POS terminal / shop) and get a password. My phone requires a password (which I can set to be arbitrarily secure, not 4-digit PIN (LOL)) or a fingerprint (which is something noone can steal, unlike a credit card... or at least I'd notice it's missing much sooner!)
  - tialaramex 7y ago
    RSA SecurID is not a smartcard. It's basically equivalent to TOTP except as a physical object rather than a phone app. There's secret baked into the SecurID and the issuer knows that secret so they can use it to generate the same one time code. You seem to imagine that your phone, on which you run most likely not only a wild variety of apps from potentially untrustworthy sources, but also a web browser, which is a huge attack surface facing the Internet, is more secure than a simple smart card and that doesn't make a whole lot of sense. In both cases the main real world security is that bad guys will probably need to _steal them_ which is difficult and a completely different skillset from the skills to make phishing emails or lie on the phone. But the phone is a bit worse here because maybe they can attack that remotely via, as I mentioned, your web browser, instant messaging stack or other components of a very complicated device.
  - LeonM 7y ago
    As I expected: you don't appear have a clue on what a smartcard actually is. > My phone requires a password (which I can set to be arbitrarily secure, not 4-digit PIN (LOL)) or a fingerprint (which is something noone can steal, unlike a credit card... or at least I'd notice it's missing much sooner!) Anyone can steal your fingerprint, and you can't reset your fingerprint like you can with a password or PIN. A smartcard will self-destruct (wipe the key material) after a number of unsuccessful PIN entries, so the chance of someone successfully guessing the PIN is ~1:3333 for a 4 digit PIN with 3 attempts. This is good enough for banks to offer fraud insurance, in the off-chance that your card gets cracked your bank will reimburse the damage. > optionally entering your PIN which you share with every POS terminal / shop) and get a password. Yes, but that would still require physical access to your card. So they'll need to have both your card and your PIN. At that point you'll need to have your card/account blocked ASAP anyway. Your bank will supply you with a new card and PIN, which is a way better solution compared to cutting off your fingers and attaching new ones ;-)