3 ms·

This might work in a B2B relationship but as an individual, there is no site on earth that is getting me to give you my bank account or driver's license info as

This might work in a B2B relationship but as an individual, there is no site on earth that is getting me to give you my bank account or driver's license info as part of a "free" or "trial" plan. Maybe. MAYBE. I'll give you a credit card number since I know I can always dispute/chargeback if you turn out to be dishonest. No way do you get anything that can't be 100% undone within a few minutes.

derefr 6y ago
> give you my bank account or driver's license info as part of a "free" or "trial" plan. Re: bank accounts, nobody was suggesting that, that's not how KYC systems work. Re: driver's license info, that's not quite how (well-implemented, modern) KYC flows work, either. For "signing up using your bank", I wasn't talking about giving the service a photo of a void cheque or anything; I was talking about doing Single Sign-On into the service, with your bank acting as the SSO (usually SAML) provider, through a SAML broker. I don't know if this is common anywhere else, but in Canada we have a pretty popular SAML SSO broker doing this (https://securekey.com/ https://securekey.com/) ; it allows you to use all our major banks as SSO authentication agents (works with both web and mobile-app flows); and this SSO method is in use for many government sites (e.g. it's how you log in to file your taxes, pay federal student loans, etc.) Any (Canadian) business can actually add SSO to their site/app through this broker. And, just like with any other (good) SSO method, the app being signed into through the SSO broker doesn't receive your credentials. Re: driver's license info, with regular KYC flows, you don't upload your driver's license info to the first party. Instead, you're directed to a trusted neutral third party (the KYC/AML provider), who has their own app; you give your credentials to that service, through its own app, which is essentially the account-creation flow for your account with that service; and then the first-party service you were interacting with SSOs you through the KYC service as an OAuth/OIDC flow.
- curryst 6y ago
  I'm not familiar enough with SSO flows to be able to quantify any kind of risk, but it makes me very uneasy when things interconnect with my bank. Everything always seems secure until it isn't. I don't mean to spread FUD, it just seems needlessly risky to make banks the central point of auth.
  - virgilp 6y ago
    It really isn't/ shouldn't be. In theory, the bank is really incentivized to provide proper and secure authentication (if someone can impersonate you to your bank, you're kinda screwed anyway). So, it only makes sense to trust a bank to provide the authentication service. One should realize that SSO integration with a bank doesn't mean 3rd party has any sort of access to the bank - it' just means that you authorize your bank to tell a 3rd party "yes, I believe this is really curryst"). Doesn't increase the attack surface for you - it only increases the "blast radius" if someone successfully compromises your bank account. But that one is typically already a dire situation.
    - vetinari 6y ago
      It does increase the risk for you, the same way using Google or Facebook account does. Once the bank won't authenticate you for some reason, all the accounts bound to this SSO provider also go the way of dodo.
- dkersten 6y ago
  > I was talking about doing Single Sign-On into the service, with your bank acting as the SSO (usually SAML) provider Personally, I use my bank only for banking and would never ever consider using them as an SSO provider. They handle my money, I don't want them to handle anything else or have any more information about me than they already do. Also, in my personal experience, the banks aren't very technologically competent, so the less they are expected to do, the better.

derefr 6y ago

> give you my bank account or driver's license info as part of a "free" or "trial" plan. Re: bank accounts, nobody was suggesting that, that's not how KYC systems work. Re: driver's license info, that's not quite how (well-implemented, modern) KYC flows work, either. For "signing up using your bank", I wasn't talking about giving the service a photo of a void cheque or anything; I was talking about doing Single Sign-On into the service, with your bank acting as the SSO (usually SAML) provider, through a SAML broker. I don't know if this is common anywhere else, but in Canada we have a pretty popular SAML SSO broker doing this (https://securekey.com/ https://securekey.com/) ; it allows you to use all our major banks as SSO authentication agents (works with both web and mobile-app flows); and this SSO method is in use for many government sites (e.g. it's how you log in to file your taxes, pay federal student loans, etc.) Any (Canadian) business can actually add SSO to their site/app through this broker. And, just like with any other (good) SSO method, the app being signed into through the SSO broker doesn't receive your credentials. Re: driver's license info, with regular KYC flows, you don't upload your driver's license info to the first party. Instead, you're directed to a trusted neutral third party (the KYC/AML provider), who has their own app; you give your credentials to that service, through its own app, which is essentially the account-creation flow for your account with that service; and then the first-party service you were interacting with SSOs you through the KYC service as an OAuth/OIDC flow.

curryst 6y ago
I'm not familiar enough with SSO flows to be able to quantify any kind of risk, but it makes me very uneasy when things interconnect with my bank. Everything always seems secure until it isn't. I don't mean to spread FUD, it just seems needlessly risky to make banks the central point of auth.
- virgilp 6y ago
  It really isn't/ shouldn't be. In theory, the bank is really incentivized to provide proper and secure authentication (if someone can impersonate you to your bank, you're kinda screwed anyway). So, it only makes sense to trust a bank to provide the authentication service. One should realize that SSO integration with a bank doesn't mean 3rd party has any sort of access to the bank - it' just means that you authorize your bank to tell a 3rd party "yes, I believe this is really curryst"). Doesn't increase the attack surface for you - it only increases the "blast radius" if someone successfully compromises your bank account. But that one is typically already a dire situation.
  - vetinari 6y ago
    It does increase the risk for you, the same way using Google or Facebook account does. Once the bank won't authenticate you for some reason, all the accounts bound to this SSO provider also go the way of dodo.
dkersten 6y ago
> I was talking about doing Single Sign-On into the service, with your bank acting as the SSO (usually SAML) provider Personally, I use my bank only for banking and would never ever consider using them as an SSO provider. They handle my money, I don't want them to handle anything else or have any more information about me than they already do. Also, in my personal experience, the banks aren't very technologically competent, so the less they are expected to do, the better.