5 ms·
Ask HN: Bank with Yubikey support?
Yesterday I got an SMS 2FA text from my bank for a login attempt that I did not trigger. I changed my password, alerted my bank, and have been checking my account balance every few minutes it seems, but luckily everything seems fine.
The experience got me thinking, because the SMS 2FA was seemingly the last defense saving my account from a breach. My bank doesn't offer a stronger form of 2FA—neither TOTP nor any form of U2F.
Meanwhile, I really love Yubikeys; I have one plugged into every laptop I own (work and personal). I use Touch ID or Face ID on sites I access frequently from mobile.
It seems that the one place where U2F would be really impactful is online banking, but I've struggled figuring out which banks support strong 2FA without first creating an account with the bank.
Does your bank offer U2F, FIDO2, WebAuthn or any other form of hardware security token mechanism for logins? Have you had otherwise positive or negative experiences with the bank overall?
- GloriousKoji 4y agoThe ONLY financial institute I trust with large sums of money and supports yubikey is Vanguard. Also check out the list of works with yubikey, but it's super short and most of them are for crypto: https://www.yubico.com/works-with-yubikey/catalog/?usecase=15&sort=popular https://www.yubico.com/works-with-yubikey/catalog/?usecase=1...
- whitepoplar 4y agoLast time I checked, Vanguard's implementation is worthless because you can still request an SMS code as an alternate path.
- atonse 4y agoDid I miss something? Is SMS totally broken? I know it’s not encrypted but has it suddenly become easy to intercept?
- qmarchi 4y agoSMS is based on SS7 signaling, which is broken pretty bad: https://www.techtarget.com/whatis/definition/SS7-attack https://www.techtarget.com/whatis/definition/SS7-attack There's also SIM-swap attacks that rely on social engineering your carrier.
- aaaaaaaaata 4y agoYes, to everything except "suddenly".
- gshakir 4y agoBank of America offers it. It works great, but it works only on desktop not on IOS app.
- tanelpoder 4y agoBut they still allow using 2FA via SMS too, even if a yubikey is configured. And there’s no way to turn the SMS auth off (last time I checked).
- vineyardmike 4y agoNot a BoA user, but how does iOS work? Do they bypass the auth requirements?
- RockRobotRock 4y agoI bank with Chase, and their passwords aren't even case sensitive.
- pridkett 4y agoYou should try Fidelity, it’s even worse. To authenticate over their phone you punch in the digits that correspond to the characters of your password. Special characters all get mapped to zero. This is TONS of fun when you use a password manager and have a long a random string password. It’s even more fun when you realize that they give you a limited amount of time to authenticate and it’s nowhere near long enough for a 20 character password. It’s really sad how bad authentication systems are for some of the most critical systems in our lives.
- greenie_beans 4y agowouldn't it be nice if we could see the relevant part of the server logs when this happens? it would cut down on my paranoia. at least give me an ip address even though it's probably worthless.
- toomuchtodo 4y agoMorgan Stanley and BoA.
- ed_db 4y agoRegarding the UK here is a similar discussion on reddit https://www.reddit.com/r/UKPersonalFinance/comments/r7vvcj/what_is_your_banks_2fa_mechanism_specifically_the/ https://www.reddit.com/r/UKPersonalFinance/comments/r7vvcj/w...
- guenthert 4y agoSolution in search of a problem or just plain advertising? I rather see banks use some sensible authentication standard (perhaps, not necessarily, 2FA; likely, but preferably not using passwords), then a random for-profit company's product. Yubikeys are first and foremost baffling expensive.
- RockRobotRock 4y agoYou think YubiKey needs to advertise on a message board for paranoid tech nerds? nobody just found out about yubikey from this thread...
- rolandog 4y ago> a message board for paranoid tech nerds? Ah, this explains why I feel at home in this community.
- aaaaaaaaata 4y agoDon't worry, you're not paranoid, you're just not missing relevant knowledge, or a mouthbreather.
- aaaaaaaaata 4y agoPS consider dropping Keybase
- rolandog 4y agoThanks for the advice! Had forgotten to remove it from here.
- CodeWriter23 4y ago$8-$50 is "baffling expensive"? I think if it protects a few grand in the bank, well worth it. If you don't have a few grand in the bank, I think maybe yeah any non-free 2FA solution becomes "expensive".
- 4y ago
- dzhiurgis 4y agoHow about modern e-banks like wise and revolut? They have tons of features and generally use mobile app for auth (not exactly same as yubi but way better than SMS)
- lykahb 4y agoAt Mercury (banking stack for startups) we plan to add WebAuthn as a second factor. This allows Yubikey, TouchID and many other compatible authenticators.
- billdietrich1 4y agoNot YubiKey, but: ETrade (now being acquired by JP Morgan) uses the Symantec VIP hardware token. A quick search for JP Morgan 2FA leads me to believe that JP Morgan uses something similar. On my ETrade account, I give username and password, then press button on hardware token, get 6-digit TOTP, and append that to the password, then click Login. Works pretty well, except that linking services such as Plaid don't understand it. Now that Wise (formerly Transferwise) has switched to use Plaid, I have to disable 2FA from my ETrade account, do the transfer in Wise, then enable 2FA again. Works, but a pain.
- vineyardmike 4y ago(Morgan Stanley acquired E*Trade)
- vineyardmike 4y agoI use Interactive Brokers for my investments (can also be a checking account since it supports ACH and debit card). They have an app “Ibkr key” feature where you get a push notification to auth. They also allow different uname/Pword combos with different auth levels. (Enterprise level granularity). Eg I keep the read-only combo on my phones password manager, a general read/write to investments on my computer, and an “admin” level access (change permissions add banks move money) in offline storage.