4 ms·
All about right, I would add that almost all of the major brokers support (now Symantec owned) securID like E-Trade and it can be a hardware token or app.. But
by foolmeonce 6y ago
All about right, I would add that almost all of the major brokers support (now Symantec owned) securID like E-Trade and it can be a hardware token or app.. But it is usually poorly integrated and impossible to support (i.e. you can't register a backup token) so if you asked to enable it they will probably disable it with basically no check.
- zxcvbn4038 6y agoTOTP and U2F solve so many of those problems, I can not explain why banks are so resistent to them - though I've long suspected that they use SMS as an excuse to compile lists of phone numbers they sell to data brokers. You would think banks would fall over themselves to support U2F just because they could sell branded keys at a markup, or require customers to provide their own. Admittedly Firefox really set back U2F by resisting supporting it for so many years. It is getting better but a lot of the sites that do support U2F still gate it on user agent, so if you are not using Chrome they don't even try. That doesn't explain TOTP though.
- foolmeonce 6y agoSecurId as implemented is sadly TOTP done right for the most sensitive accounts of very large organizations which are the cash cows to financials. They don't want cloning by copying a QR code. Each employee must have something they would have to physically share or it's not better than a longer password. They don't care if one employee is locked out for a week. I think U2F solves all the problems if the bank sends the pre-registered key, but standard TOTP isn't going to work.