6 ms·

This sounds so futuristic which is awesome but at the same time banks like Tangerine, which otherwise I have nothing but praise for, don't even allow be to use

This sounds so futuristic which is awesome but at the same time banks like Tangerine, which otherwise I have nothing but praise for, don't even allow be to use a password more secure than a 4-6 digit numeric passcode. Obviously no 2FA. Sorry, that has little to do with the submission, I just had to vent about banks.

SevenSigs 5y ago
> Tangerine At least they used to have decent interest rates... now what's the point? they don't even have physical banks.
- barbazoo 5y ago
  Overall it's a pretty good deal, no fee accounts, unlimited etransfers, decent credit card, good customer support, things like that. Back when I was shopping for no fee accounts this was the best deal there was.
  - midasuni 5y ago
    That’s all standard in the UK, why are US banks so different?
- james_pm 5y ago
  Low/no fees mostly. A standard bank account at the big banks gives you few Interac transactions, for example, unless you either pay $12.99 a month or have >$3,000 in your account at all times. Tangerine provides unlimited Interac payments on a chequing account with no monthly fee.
  - deleted 5y ago
    [deleted]
gregsadetsky 5y ago
2FA is so seriously lacking here it's not funny. TD Bank has 2FA which has been SMS-based for a very long time, and they just introduced a 2FA app. FYI. But yes on Tangerine (and other banks) being so, so behind. Sending a wire online here is pretty much impossible..!
- ghostpepper 5y ago
  As a TD customer, this is mildly infuriating. Is there any legitimate security rationale for forcing me to install their authenticator app instead of simply allowing me to use any industry-standard TOTP app (Authy, Google Authenticator, etc). Not to mention the fact that they still don't allow hardware tokens / U2F eg. Yubikey.
  - coldacid 5y ago
    I'd like to know as well. There could very well be some auditing requirement that forces them to explicitly generate the tokens sent to users, and the people enforcing the requirement have sticks up their asses. It wouldn't be the first time that the auditors foul up something because despite working as well or better than what they want, it's not what they know.
heavyset_go 5y ago
> Obviously no 2FA. Don't worry, you really aren't missing out on much security because the 2FA most banks implement just involves sending you an SMS.
- JamisonM 5y ago
  But sending you an SMS is a lot more security than no 2FA at all, right? I am aware of attacks that state/very sophisticated actors can use to intercept SMS messages but that's a serious edge case for a normal person, right?
  - newsclues 5y ago
    No, it’s a fairly simple social engineering attack and the telco customer service will do it for you at the cost of a SIM card.
  - heavyset_go 5y ago
    It's better than nothing, I just wish it wasn't conflated with effective 2FA. It isn't just state-level or sophisticated actors, it's anyone who is dumb enough to commit fraud with computers or via unauthorized access to telecom networks, which includes a lot of fraud rings. According to The Verge[1], such services are even advertised on illicit marketplaces, so anyone with some Bitcoin and the Tor Browser can potentially be your adversary in such an attack. [1] https://www.theverge.com/2017/6/13/15794292/ss7-hack-dark-web-tap-phone-texts-cyber-crime https://www.theverge.com/2017/6/13/15794292/ss7-hack-dark-we...
  - franga2000 5y ago
    Depends on where you are - a SIM swap attack is surprisingly easy to do in many places. But more generally, a sophisticated actor doesn't have to be targeting you specifically. Many people assume that "nobody would put in so much effort to steal from me", but they don't have to be. A sophisticated attacker with the capability to intercept SMS would likely be casting a very wide net. Once people start noticing, they'll be locked out very soon, so they'll be aiming to "hack" as many people as possible. You might just happen to be one of the N random people that happened to log into their bank on the day of the hack and the spreadsheet happened to be sorted by last login time. Hackers don't discriminate, so as long as you fit "SELECT from account WHERE balance > 0", you'll be on the target list.
nelblu 5y ago
Tangerine recently launched 2FA but it is SMS based only.
- barbazoo 5y ago
  I don't see that anywhere in the security settings. Not that I want SMS 2FA.
dc3k 5y ago
With Tangerine I have set up the secret question thing where my answers are secure passwords generated with my password manager. Their login asks for the secure question answer before the 4-6 digit useless pin entry, so it has that going for it at least. I refuse to set up SMS based 2FA.

SevenSigs 5y ago

> Tangerine At least they used to have decent interest rates... now what's the point? they don't even have physical banks.

barbazoo 5y ago
Overall it's a pretty good deal, no fee accounts, unlimited etransfers, decent credit card, good customer support, things like that. Back when I was shopping for no fee accounts this was the best deal there was.
- midasuni 5y ago
  That’s all standard in the UK, why are US banks so different?
james_pm 5y ago
Low/no fees mostly. A standard bank account at the big banks gives you few Interac transactions, for example, unless you either pay $12.99 a month or have >$3,000 in your account at all times. Tangerine provides unlimited Interac payments on a chequing account with no monthly fee.
- deleted 5y ago
  [deleted]

gregsadetsky 5y ago

2FA is so seriously lacking here it's not funny. TD Bank has 2FA which has been SMS-based for a very long time, and they just introduced a 2FA app. FYI. But yes on Tangerine (and other banks) being so, so behind. Sending a wire online here is pretty much impossible..!

ghostpepper 5y ago
As a TD customer, this is mildly infuriating. Is there any legitimate security rationale for forcing me to install their authenticator app instead of simply allowing me to use any industry-standard TOTP app (Authy, Google Authenticator, etc). Not to mention the fact that they still don't allow hardware tokens / U2F eg. Yubikey.
- coldacid 5y ago
  I'd like to know as well. There could very well be some auditing requirement that forces them to explicitly generate the tokens sent to users, and the people enforcing the requirement have sticks up their asses. It wouldn't be the first time that the auditors foul up something because despite working as well or better than what they want, it's not what they know.

heavyset_go 5y ago

> Obviously no 2FA. Don't worry, you really aren't missing out on much security because the 2FA most banks implement just involves sending you an SMS.

JamisonM 5y ago
But sending you an SMS is a lot more security than no 2FA at all, right? I am aware of attacks that state/very sophisticated actors can use to intercept SMS messages but that's a serious edge case for a normal person, right?
- newsclues 5y ago
  No, it’s a fairly simple social engineering attack and the telco customer service will do it for you at the cost of a SIM card.
- heavyset_go 5y ago
  It's better than nothing, I just wish it wasn't conflated with effective 2FA. It isn't just state-level or sophisticated actors, it's anyone who is dumb enough to commit fraud with computers or via unauthorized access to telecom networks, which includes a lot of fraud rings. According to The Verge[1], such services are even advertised on illicit marketplaces, so anyone with some Bitcoin and the Tor Browser can potentially be your adversary in such an attack. [1] https://www.theverge.com/2017/6/13/15794292/ss7-hack-dark-web-tap-phone-texts-cyber-crime https://www.theverge.com/2017/6/13/15794292/ss7-hack-dark-we...
- franga2000 5y ago
  Depends on where you are - a SIM swap attack is surprisingly easy to do in many places. But more generally, a sophisticated actor doesn't have to be targeting you specifically. Many people assume that "nobody would put in so much effort to steal from me", but they don't have to be. A sophisticated attacker with the capability to intercept SMS would likely be casting a very wide net. Once people start noticing, they'll be locked out very soon, so they'll be aiming to "hack" as many people as possible. You might just happen to be one of the N random people that happened to log into their bank on the day of the hack and the spreadsheet happened to be sorted by last login time. Hackers don't discriminate, so as long as you fit "SELECT from account WHERE balance > 0", you'll be on the target list.

nelblu 5y ago

Tangerine recently launched 2FA but it is SMS based only.

barbazoo 5y ago
I don't see that anywhere in the security settings. Not that I want SMS 2FA.

dc3k 5y ago

With Tangerine I have set up the secret question thing where my answers are secure passwords generated with my password manager. Their login asks for the secure question answer before the 4-6 digit useless pin entry, so it has that going for it at least. I refuse to set up SMS based 2FA.