5 ms·

Indeed, listen to NIST: [Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.

by sliken 7y ago

cik 7y ago
It's rather sad that Canadian banks still view SMS as the best way forward. They'll text you, they'll email you, they'll validate over the phone... all of which are really this same problem. I'm waiting for the days our banks will accept multiple 2FA solutions.
- smnrchrds 7y ago
  And when you (unavoidably) get hacked, they tell you it's your fault and that it sucks to be you, because you are not getting that money back. https://www.cbc.ca/news/business/banks-deny-compensation-online-fraud-security-1.5322982 https://www.cbc.ca/news/business/banks-deny-compensation-onl...
  - nothrabannosir 7y ago
    This is insane. How are banks not liable for fraud in Canada? The incentives couldn't be worse.
  - cik 7y ago
    Tell me about it. The whole thing makes me cringe. Frequently I wonder if the goal is just to have enough insurance, such that when people and their money are separated, life is fine.
  - asdfasgasdgasdg 7y ago
    That's really surprising. In the US, the banks are responsible for fraudulent transactions.
- cbhl 7y ago
  The banks already know what happens when you issue every customer a 2FA token, because they issue you a bank card. You have to verify the customer is who they say they are before giving them the token, and have processes for dealing with a lost or stolen token.
skunkworker 7y ago
Sad that one of my current banks (Chase) won't add TOTP to their login. Edit: https://twitter.com/skunkworker/status/1131297869703438337 https://twitter.com/skunkworker/status/1131297869703438337 @ChaseSupport Hey Chase, when will offline TOTP be added for a more secure login? Thank you for reaching out! What we have is the multi-factor authentication on all online accounts. You can visit https://tinyurl.com/y7r2fztd https://tinyurl.com/y7r2fztd for more info on how we protect and secure your information. ^AA
- megous 7y ago
  I'm still looking at how to best communicate with my bank too, to get actual answers. :D Not this cookie cutter kind of support. No matter how precisely I describe the problem, I get copy paste or poorly thought out response. That's why I like smaller businesses, where there's still a connection between doers and support people, or where the doers are the support people.
  - bradtheappguy 7y ago
    I've been suffering from the same frustration, and have been thinking about switching to a smaller bank. There are apparently more than 7,000 FDIC insured institutions out there.

Indeed, listen to NIST: [Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.

by sliken 7y ago

Indeed, listen to NIST: [Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.

cik 7y ago

It's rather sad that Canadian banks still view SMS as the best way forward. They'll text you, they'll email you, they'll validate over the phone... all of which are really this same problem. I'm waiting for the days our banks will accept multiple 2FA solutions.

smnrchrds 7y ago
And when you (unavoidably) get hacked, they tell you it's your fault and that it sucks to be you, because you are not getting that money back. https://www.cbc.ca/news/business/banks-deny-compensation-online-fraud-security-1.5322982 https://www.cbc.ca/news/business/banks-deny-compensation-onl...
- nothrabannosir 7y ago
  This is insane. How are banks not liable for fraud in Canada? The incentives couldn't be worse.
- cik 7y ago
  Tell me about it. The whole thing makes me cringe. Frequently I wonder if the goal is just to have enough insurance, such that when people and their money are separated, life is fine.
- asdfasgasdgasdg 7y ago
  That's really surprising. In the US, the banks are responsible for fraudulent transactions.
cbhl 7y ago
The banks already know what happens when you issue every customer a 2FA token, because they issue you a bank card. You have to verify the customer is who they say they are before giving them the token, and have processes for dealing with a lost or stolen token.

skunkworker 7y ago

Sad that one of my current banks (Chase) won't add TOTP to their login. Edit: https://twitter.com/skunkworker/status/1131297869703438337 https://twitter.com/skunkworker/status/1131297869703438337 @ChaseSupport Hey Chase, when will offline TOTP be added for a more secure login? Thank you for reaching out! What we have is the multi-factor authentication on all online accounts. You can visit https://tinyurl.com/y7r2fztd https://tinyurl.com/y7r2fztd for more info on how we protect and secure your information. ^AA

megous 7y ago
I'm still looking at how to best communicate with my bank too, to get actual answers. :D Not this cookie cutter kind of support. No matter how precisely I describe the problem, I get copy paste or poorly thought out response. That's why I like smaller businesses, where there's still a connection between doers and support people, or where the doers are the support people.
- bradtheappguy 7y ago
  I've been suffering from the same frustration, and have been thinking about switching to a smaller bank. There are apparently more than 7,000 FDIC insured institutions out there.