3 ms·
TOTP and U2F solve so many of those problems, I can not explain why banks are so resistent to them - though I've long suspected that they use SMS as an excuse t
by zxcvbn4038 6y ago
TOTP and U2F solve so many of those problems, I can not explain why banks are so resistent to them - though I've long suspected that they use SMS as an excuse to compile lists of phone numbers they sell to data brokers.
You would think banks would fall over themselves to support U2F just because they could sell branded keys at a markup, or require customers to provide their own.
Admittedly Firefox really set back U2F by resisting supporting it for so many years. It is getting better but a lot of the sites that do support U2F still gate it on user agent, so if you are not using Chrome they don't even try.
That doesn't explain TOTP though.
- foolmeonce 6y agoSecurId as implemented is sadly TOTP done right for the most sensitive accounts of very large organizations which are the cash cows to financials. They don't want cloning by copying a QR code. Each employee must have something they would have to physically share or it's not better than a longer password. They don't care if one employee is locked out for a week. I think U2F solves all the problems if the bank sends the pre-registered key, but standard TOTP isn't going to work.