4 ms·

Retail banks all suck pretty uniformly when it comes to security, but depending on your financial needs you may be able to use a cash account at a brokerage - R

Retail banks all suck pretty uniformly when it comes to security, but depending on your financial needs you may be able to use a cash account at a brokerage - Robin Hood is a stand out that allows both 2FA and disabling external ACH. E-Trade is stuck in the 90s but sell you a hardware token that you can use for logins - don’t know what happens when the battery runs out. Not a brokerage but PayPal has 2FA w/ totp but with them the problem is they might decide to seize your funds at any moment with no explanation or recourse so I would not keep a balance with them. I think that is it for the US - every other bank either has no 2FA, or they allow you to bypass 2FA with SMS, they disable 2FA every thirty days and make you use your password and/or SMS to login and re-activate it. Biggest tragedy was when NIST decided SMS was better then nothing for 2FA and dropped all the language against it in their publications. Before that I could point to them and say here are all the problems with SMS, now pro-SMS people do the same to me.

foolmeonce 6y ago
All about right, I would add that almost all of the major brokers support (now Symantec owned) securID like E-Trade and it can be a hardware token or app.. But it is usually poorly integrated and impossible to support (i.e. you can't register a backup token) so if you asked to enable it they will probably disable it with basically no check.
- zxcvbn4038 6y ago
  TOTP and U2F solve so many of those problems, I can not explain why banks are so resistent to them - though I've long suspected that they use SMS as an excuse to compile lists of phone numbers they sell to data brokers. You would think banks would fall over themselves to support U2F just because they could sell branded keys at a markup, or require customers to provide their own. Admittedly Firefox really set back U2F by resisting supporting it for so many years. It is getting better but a lot of the sites that do support U2F still gate it on user agent, so if you are not using Chrome they don't even try. That doesn't explain TOTP though.
  - foolmeonce 6y ago
    SecurId as implemented is sadly TOTP done right for the most sensitive accounts of very large organizations which are the cash cows to financials. They don't want cloning by copying a QR code. Each employee must have something they would have to physically share or it's not better than a longer password. They don't care if one employee is locked out for a week. I think U2F solves all the problems if the bank sends the pre-registered key, but standard TOTP isn't going to work.
piracy1 6y ago
> E-Trade is stuck in the 90s but sell you a hardware token that you can use for logins - don’t know what happens when the battery runs out. Just requested one so I'll find out. It looks like you load the key value onto the key. It's like a little client that does google auth (but it's some shit by Symantec) . If the battery runs out I think you can load that value onto a phone with the Symantec app.

foolmeonce 6y ago

All about right, I would add that almost all of the major brokers support (now Symantec owned) securID like E-Trade and it can be a hardware token or app.. But it is usually poorly integrated and impossible to support (i.e. you can't register a backup token) so if you asked to enable it they will probably disable it with basically no check.

zxcvbn4038 6y ago
TOTP and U2F solve so many of those problems, I can not explain why banks are so resistent to them - though I've long suspected that they use SMS as an excuse to compile lists of phone numbers they sell to data brokers. You would think banks would fall over themselves to support U2F just because they could sell branded keys at a markup, or require customers to provide their own. Admittedly Firefox really set back U2F by resisting supporting it for so many years. It is getting better but a lot of the sites that do support U2F still gate it on user agent, so if you are not using Chrome they don't even try. That doesn't explain TOTP though.
- foolmeonce 6y ago
  SecurId as implemented is sadly TOTP done right for the most sensitive accounts of very large organizations which are the cash cows to financials. They don't want cloning by copying a QR code. Each employee must have something they would have to physically share or it's not better than a longer password. They don't care if one employee is locked out for a week. I think U2F solves all the problems if the bank sends the pre-registered key, but standard TOTP isn't going to work.

piracy1 6y ago

> E-Trade is stuck in the 90s but sell you a hardware token that you can use for logins - don’t know what happens when the battery runs out. Just requested one so I'll find out. It looks like you load the key value onto the key. It's like a little client that does google auth (but it's some shit by Symantec) . If the battery runs out I think you can load that value onto a phone with the Symantec app.