4 ms·

The tricky bit is I know some legitimate departments of my bank follow this policy -- so if they make an outbound call to me, they will trust what I say on the

by cbhl 5y ago

The tricky bit is I know some legitimate departments of my bank follow this policy -- so if they make an outbound call to me, they will trust what I say on the phone, but if I hang up and call them back, they will take down my number and call me back later.

wcarss 5y ago
unfortunately, trust is a two way street!
gonehome 5y ago
Even worse Morgan Stanley will ask you for two factor codes over the phone(!). It’s impossible to implement good user behavior when the banks themselves are wildly negligent.
- lowercased 5y ago
  I tried to buy something, but it was a large amount - over my normal usage. I had to call the bank, and they said "we're sending a code to your phone..." and the text message said "DO NOT share this code. We will NEVER call you or text you for it. Code xxxxxx. Reply HELP if you didn't request it." So... they then say "what is the code?" that specifically says "DO NOT share this code". I know what's going on, mostly, but it was still confusing.
  - smaccona 5y ago
    It’s worth pointing out that if you are not the one initiating the call, then this is a legitimate attack vector, and not just via SMS text message or email two factor but also any type of OTP. The attack goes like this: (1) given that the whole point of two-factor auth is to prevent access to your account in the event that your primary authentication tokens (usually a username and password) are compromised, let’s assume for this attack that a bad actor already knows your username and password. (2) the attacker calls you up and says “this is <your bank>”, then (3) the attacker logs into your account with the username and password they already know (4) this either triggers an email or text message with the second factor, or if you use a hardware token or an app then the code is available there. Either way, the attacker requests you to read back the code over the phone (5) the attacker uses this secondary code to gain access to your account, and can then take any action including changing your password and 2nd factor setup. I think this is the reason security teams set up these messages to say things like “NEVER share this code!” and the like.
  - lokedhs 5y ago
    It was definitely poorly written. It's correct, since they never called you, it was you who called them. But it does raise the question as to how to teach people that who initiates the contact is very important and completely changes the security analysis.
    - lowercased 5y ago
      The message should have read "You were speaking to one of our agents who indicated in the last minute or so they would send you a confirmation code. The code is XXXXX. Do not give this to anyone unless you initiated contact with our bank." Or... something closer to the actual scenario as it was playing out.

by cbhl 5y ago

wcarss 5y ago

unfortunately, trust is a two way street!

gonehome 5y ago

Even worse Morgan Stanley will ask you for two factor codes over the phone(!). It’s impossible to implement good user behavior when the banks themselves are wildly negligent.

lowercased 5y ago
I tried to buy something, but it was a large amount - over my normal usage. I had to call the bank, and they said "we're sending a code to your phone..." and the text message said "DO NOT share this code. We will NEVER call you or text you for it. Code xxxxxx. Reply HELP if you didn't request it." So... they then say "what is the code?" that specifically says "DO NOT share this code". I know what's going on, mostly, but it was still confusing.
- smaccona 5y ago
  It’s worth pointing out that if you are not the one initiating the call, then this is a legitimate attack vector, and not just via SMS text message or email two factor but also any type of OTP. The attack goes like this: (1) given that the whole point of two-factor auth is to prevent access to your account in the event that your primary authentication tokens (usually a username and password) are compromised, let’s assume for this attack that a bad actor already knows your username and password. (2) the attacker calls you up and says “this is <your bank>”, then (3) the attacker logs into your account with the username and password they already know (4) this either triggers an email or text message with the second factor, or if you use a hardware token or an app then the code is available there. Either way, the attacker requests you to read back the code over the phone (5) the attacker uses this secondary code to gain access to your account, and can then take any action including changing your password and 2nd factor setup. I think this is the reason security teams set up these messages to say things like “NEVER share this code!” and the like.
- lokedhs 5y ago
  It was definitely poorly written. It's correct, since they never called you, it was you who called them. But it does raise the question as to how to teach people that who initiates the contact is very important and completely changes the security analysis.
  - lowercased 5y ago
    The message should have read "You were speaking to one of our agents who indicated in the last minute or so they would send you a confirmation code. The code is XXXXX. Do not give this to anyone unless you initiated contact with our bank." Or... something closer to the actual scenario as it was playing out.