3 ms·

Bank of America uses insecure driver's license numbers for 2FA

• deleted 4y ago
  [deleted]
• netsharc 4y ago
  Haha, at least their bot reacted to the username mention...
• smileysteve 4y ago
  Better drivers license than social security numbers right?
• deleted 4y ago
  [deleted]
• VTimofeenko 4y ago
  OTOH they do support hardware security tokens for 2FA, and even require them for some operations.
  • WirelessGigabit 4y ago
    Hardware tokens without the ability to disable SMS / email is quite useless. On the iPhone, with Face ID enabled, I still need to wait for the text. That on its own is incredibly stupid because it is a protected device. To unlock it I had to put in a pin / Face unlock, and for the app I had to do another face unlock. And I cannot do yubikey on the iPhone. it MUST be sms / call.
    • VTimofeenko 4y ago
      > Hardware tokens without the ability to disable SMS / email is quite useless. I agree. On a desktop it's possible to bypass the hardware token and use the SMS which cannot be disabled AFAIU. > And I cannot do yubikey on the iPhone. it MUST be sms / call. Huh, did not know that. Not even the nfc version works?