4 ms·

And yet my bank (Chase) only supports email and sms 2fa with no option for OTP/TOTP. Is this just a institution dragging their feet or are there more regulatory

And yet my bank (Chase) only supports email and sms 2fa with no option for OTP/TOTP. Is this just a institution dragging their feet or are there more regulatory reasons why they won't allow more secure authentication?

rconti 7y ago
at least one of my banks cannot SMS me codes, I can't remmeber which, so I always forget, try it, and have to select another method. I THINK it's chase, but I'm not sure. They have my correct phone number, but for years now, the code just... never shows up.
- StavrosK 7y ago
  Are you using Google Voice? I have the same problem with Chase on my GV number. Calling works fine, and so does email, but no SMS.
  - 1996 7y ago
    Port a number to GV, it will work, but you are at risk of losing it if you don't log in often enough. I lost an important number that way (along with my grand fathered free google apps account for my domain)
    - davchana 7y ago
      I have few personal google apps grandfathered account, & I think it sends an email to all admins if you do not log into it for about 10 months.
0xEFF 7y ago
It’s more to make customers feel better than for security.
techsupporter 7y ago
At least they offer codes via email. I can (and do) secure access to my email account and domain registration with a very long password and a Yubikey. That’s “good enough” for my purposes.
- craftyguy 7y ago
  "secure" and "email" really do not belong in the same sentence.
- Koffiepoeder 7y ago
  Most email is unencrypted during transit, so a state level adversary can still easily intercept it. For most people this is however sufficient.
  - techsupporter 7y ago
    Absolutely, a state-level opponent could get up to some shenanigans though I would argue that a state has much easier methods to go cracking into my Visa card. My threat model doesn’t include nation states targeting me specifically because, simply, if one comes after me I am screwed anyway. As for email being unencrypted, I think most of it now is encrypted during transit (thanks to the Big Two providers knocking points off a spam score if a message does come via TLS) and even if it weren’t the password is also not known so the second factor is not useful. For example, I just tried to log in to chase.com and the code they emailed me at 1752 MST is 067315. If I’ve been phished so hard that posting this is useful, again I’m screwed.
  - fulafel 7y ago
    You hardly need to be "state-level" to spoof bgp or dns.
bubblethink 7y ago
For anyone who wants a US bank with TOTP, schwab works! I was pleasantly surprised to discover this. It uses some symantec stuff (as did paypal earlier), but it's TOTP underneath and can be used with any TOTP app.
closeparen 7y ago
There is even a "Use Token" button on the Chase login page, but apparently only business accounts can use it.
skunkworker 7y ago
I asked them over twitter back in may. https://twitter.com/skunkworker/status/1131297869703438337 https://twitter.com/skunkworker/status/1131297869703438337

rconti 7y ago

at least one of my banks cannot SMS me codes, I can't remmeber which, so I always forget, try it, and have to select another method. I THINK it's chase, but I'm not sure. They have my correct phone number, but for years now, the code just... never shows up.

StavrosK 7y ago
Are you using Google Voice? I have the same problem with Chase on my GV number. Calling works fine, and so does email, but no SMS.
- 1996 7y ago
  Port a number to GV, it will work, but you are at risk of losing it if you don't log in often enough. I lost an important number that way (along with my grand fathered free google apps account for my domain)
  - davchana 7y ago
    I have few personal google apps grandfathered account, & I think it sends an email to all admins if you do not log into it for about 10 months.

0xEFF 7y ago

It’s more to make customers feel better than for security.

techsupporter 7y ago

At least they offer codes via email. I can (and do) secure access to my email account and domain registration with a very long password and a Yubikey. That’s “good enough” for my purposes.

craftyguy 7y ago
"secure" and "email" really do not belong in the same sentence.
Koffiepoeder 7y ago
Most email is unencrypted during transit, so a state level adversary can still easily intercept it. For most people this is however sufficient.
- techsupporter 7y ago
  Absolutely, a state-level opponent could get up to some shenanigans though I would argue that a state has much easier methods to go cracking into my Visa card. My threat model doesn’t include nation states targeting me specifically because, simply, if one comes after me I am screwed anyway. As for email being unencrypted, I think most of it now is encrypted during transit (thanks to the Big Two providers knocking points off a spam score if a message does come via TLS) and even if it weren’t the password is also not known so the second factor is not useful. For example, I just tried to log in to chase.com and the code they emailed me at 1752 MST is 067315. If I’ve been phished so hard that posting this is useful, again I’m screwed.
- fulafel 7y ago
  You hardly need to be "state-level" to spoof bgp or dns.

bubblethink 7y ago

For anyone who wants a US bank with TOTP, schwab works! I was pleasantly surprised to discover this. It uses some symantec stuff (as did paypal earlier), but it's TOTP underneath and can be used with any TOTP app.

closeparen 7y ago

There is even a "Use Token" button on the Chase login page, but apparently only business accounts can use it.

skunkworker 7y ago

I asked them over twitter back in may. https://twitter.com/skunkworker/status/1131297869703438337 https://twitter.com/skunkworker/status/1131297869703438337