6 ms·

This is exactly the kind of thing that needs to start happening to actually motivate the companies to stop allowing this BS. Good luck! Also, don't have your l

This is exactly the kind of thing that needs to start happening to actually motivate the companies to stop allowing this BS. Good luck! Also, don't have your life savings in crypto, but if you must, then please for the love of everything holy don't put it someplace where a SIM swap attack is enough to get it out. Irreversible transactions are kind of the whole point of it, so you need to be much more careful with crypto credentials than, say, your bank password or credit card.

delfinom 7y ago
And they'll just hide their binding arbitration clauses.
sliken 7y ago
Indeed, listen to NIST: [Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.
- cik 7y ago
  It's rather sad that Canadian banks still view SMS as the best way forward. They'll text you, they'll email you, they'll validate over the phone... all of which are really this same problem. I'm waiting for the days our banks will accept multiple 2FA solutions.
  - smnrchrds 7y ago
    And when you (unavoidably) get hacked, they tell you it's your fault and that it sucks to be you, because you are not getting that money back. https://www.cbc.ca/news/business/banks-deny-compensation-online-fraud-security-1.5322982 https://www.cbc.ca/news/business/banks-deny-compensation-onl...
    - nothrabannosir 7y ago
      This is insane. How are banks not liable for fraud in Canada? The incentives couldn't be worse.
    - cik 7y ago
      Tell me about it. The whole thing makes me cringe. Frequently I wonder if the goal is just to have enough insurance, such that when people and their money are separated, life is fine.
    - asdfasgasdgasdg 7y ago
      That's really surprising. In the US, the banks are responsible for fraudulent transactions.
  - cbhl 7y ago
    The banks already know what happens when you issue every customer a 2FA token, because they issue you a bank card. You have to verify the customer is who they say they are before giving them the token, and have processes for dealing with a lost or stolen token.
- skunkworker 7y ago
  Sad that one of my current banks (Chase) won't add TOTP to their login. Edit: https://twitter.com/skunkworker/status/1131297869703438337 https://twitter.com/skunkworker/status/1131297869703438337 @ChaseSupport Hey Chase, when will offline TOTP be added for a more secure login? Thank you for reaching out! What we have is the multi-factor authentication on all online accounts. You can visit https://tinyurl.com/y7r2fztd https://tinyurl.com/y7r2fztd for more info on how we protect and secure your information. ^AA
  - megous 7y ago
    I'm still looking at how to best communicate with my bank too, to get actual answers. :D Not this cookie cutter kind of support. No matter how precisely I describe the problem, I get copy paste or poorly thought out response. That's why I like smaller businesses, where there's still a connection between doers and support people, or where the doers are the support people.
    - bradtheappguy 7y ago
      I've been suffering from the same frustration, and have been thinking about switching to a smaller bank. There are apparently more than 7,000 FDIC insured institutions out there.
ezoe 7y ago
No matter how careful you are, the service(bank, SNS and everything) you're using aren't. If you hand over them a phone number and they think phone number alone can identity you, you're done for. The only solution is not using the phone. The phone reached it's limit. It's not trustworthy communication method.
jokoon 7y ago
> Also, don't have your life savings in crypto Exactly. Cryptocurrency, in my view, are meant to be intermediary currency. Keeping a lot of it is just too risky. Tech nerds seem to like cryptocurrencies because it's a cool and fancy gadget, but the reality is that normal banks are more secure. If your money gets stolen, banks can trace it, cancel transactions, and there are insurances in place to recover your money. Governments are involved in bank security. Currencies are not trivial things. Only libertarians and anti-government, anti-federal-reserve people will actually prefer cryptocurrencies to their own risk. I get that the AT&T employee is guilty, but the victim was asking for it.
close04 7y ago
> Irreversible transactions are kind of the whole point of it Just as a sidenote, the problem isn't that the transactions are irreversible, they're also irreversible for banks. You never reverse the actual transaction, you just create another transaction in the opposite direction. Sometimes banks accidentally sent money to the wrong (foreign) bank and kissed them goodbye. The other bank had no obligation to send it back and if the 2 don't have a relationship and don't plan on having one it's free money for the recipient. The difference with crypto is that you're basically dealing with "untrustworthy" parties since there's no central trustworthy authority over the whole network. The advantage is that nobody can control the network. The disadvantage is that you have no leverage over the receiving party. It's like a private individual ad-hoc lending money to a friend vs. lending money to a total stranger. There's probably no legal obligation to return it but friends most likely will.
- asdfasgasdgasdg 7y ago
  From the perspective of the bank customer, in the US, bank transactions are reversible, by fiat. It does not matter to the customer whether the bank is out money or not. All that matters is that you are made whole in the case of a fraudulent transaction.

delfinom 7y ago

And they'll just hide their binding arbitration clauses.

sliken 7y ago

Indeed, listen to NIST: [Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.

cik 7y ago
It's rather sad that Canadian banks still view SMS as the best way forward. They'll text you, they'll email you, they'll validate over the phone... all of which are really this same problem. I'm waiting for the days our banks will accept multiple 2FA solutions.
- smnrchrds 7y ago
  And when you (unavoidably) get hacked, they tell you it's your fault and that it sucks to be you, because you are not getting that money back. https://www.cbc.ca/news/business/banks-deny-compensation-online-fraud-security-1.5322982 https://www.cbc.ca/news/business/banks-deny-compensation-onl...
  - nothrabannosir 7y ago
    This is insane. How are banks not liable for fraud in Canada? The incentives couldn't be worse.
  - cik 7y ago
    Tell me about it. The whole thing makes me cringe. Frequently I wonder if the goal is just to have enough insurance, such that when people and their money are separated, life is fine.
  - asdfasgasdgasdg 7y ago
    That's really surprising. In the US, the banks are responsible for fraudulent transactions.
- cbhl 7y ago
  The banks already know what happens when you issue every customer a 2FA token, because they issue you a bank card. You have to verify the customer is who they say they are before giving them the token, and have processes for dealing with a lost or stolen token.
skunkworker 7y ago
Sad that one of my current banks (Chase) won't add TOTP to their login. Edit: https://twitter.com/skunkworker/status/1131297869703438337 https://twitter.com/skunkworker/status/1131297869703438337 @ChaseSupport Hey Chase, when will offline TOTP be added for a more secure login? Thank you for reaching out! What we have is the multi-factor authentication on all online accounts. You can visit https://tinyurl.com/y7r2fztd https://tinyurl.com/y7r2fztd for more info on how we protect and secure your information. ^AA
- megous 7y ago
  I'm still looking at how to best communicate with my bank too, to get actual answers. :D Not this cookie cutter kind of support. No matter how precisely I describe the problem, I get copy paste or poorly thought out response. That's why I like smaller businesses, where there's still a connection between doers and support people, or where the doers are the support people.
  - bradtheappguy 7y ago
    I've been suffering from the same frustration, and have been thinking about switching to a smaller bank. There are apparently more than 7,000 FDIC insured institutions out there.

ezoe 7y ago

No matter how careful you are, the service(bank, SNS and everything) you're using aren't. If you hand over them a phone number and they think phone number alone can identity you, you're done for. The only solution is not using the phone. The phone reached it's limit. It's not trustworthy communication method.

jokoon 7y ago

> Also, don't have your life savings in crypto Exactly. Cryptocurrency, in my view, are meant to be intermediary currency. Keeping a lot of it is just too risky. Tech nerds seem to like cryptocurrencies because it's a cool and fancy gadget, but the reality is that normal banks are more secure. If your money gets stolen, banks can trace it, cancel transactions, and there are insurances in place to recover your money. Governments are involved in bank security. Currencies are not trivial things. Only libertarians and anti-government, anti-federal-reserve people will actually prefer cryptocurrencies to their own risk. I get that the AT&T employee is guilty, but the victim was asking for it.

close04 7y ago

> Irreversible transactions are kind of the whole point of it Just as a sidenote, the problem isn't that the transactions are irreversible, they're also irreversible for banks. You never reverse the actual transaction, you just create another transaction in the opposite direction. Sometimes banks accidentally sent money to the wrong (foreign) bank and kissed them goodbye. The other bank had no obligation to send it back and if the 2 don't have a relationship and don't plan on having one it's free money for the recipient. The difference with crypto is that you're basically dealing with "untrustworthy" parties since there's no central trustworthy authority over the whole network. The advantage is that nobody can control the network. The disadvantage is that you have no leverage over the receiving party. It's like a private individual ad-hoc lending money to a friend vs. lending money to a total stranger. There's probably no legal obligation to return it but friends most likely will.

asdfasgasdgasdg 7y ago
From the perspective of the bank customer, in the US, bank transactions are reversible, by fiat. It does not matter to the customer whether the bank is out money or not. All that matters is that you are made whole in the case of a fraudulent transaction.