4 ms·

Losing access to a phone means losing access to your TOTP codes as well. So that's no different than losing access to SMS. TOTP codes can be shared between mul

by edent 4y ago

Losing access to a phone means losing access to your TOTP codes as well. So that's no different than losing access to SMS. TOTP codes can be shared between multiple devices - which makes them less unique than an SMS to a specific MSISDN. Your ability to back up a code doesn't necessarily mean you have the ability to store it securely. FIDO tokens can also be lost. I don't know why you're asking for your congress to fix this. You live in a free market, so move your business to someone who you think takes security seriously.

seanw444 4y ago
Didn't you hear? Free market's out of style. Goverment mandates and bloated legislation are the new norm.
- codegeek 4y ago
  Changing banks is not free market just like Changing Insurance Companies. Most banks in US enforce SMS 2FA. I would rather want the choice of not doing SMS 2FA. If you cannot implement better 2FA, dont force me to use SMS 2FA and I assume the risk on my end. That's Free Market.
ghaff 4y ago
You basically need a backup token of some sort. Which, of course, makes them an even tougher sale to a mainstream audience.
hedora 4y ago
For SMS auth, you can get the cell company to re-issue a sim if you lose your phone. This is a feature and a bug, thanks to social engineering attacks. Also, the SMS transport layer isn't secure. With TOTP, you can put the TOTP code in your password manager with all your other passwords, which is probably what I will do it it catches on. It's effectively one factor at that point. (Do you know my password manager's password?)
codegeek 4y ago
"so move your business to someone who you think takes security seriously." For banks, it is not that easy and convenient. I like my banks for many reasons except the 2FA thing. Most banks at least in US are still doing SMS 2FA. I am done with the whole "If not happy, move" and want to figure out what we can do to educate/force these banks to do the correct way.
- q-big 4y ago
  > I am done with the whole "If not happy, move" and want to figure out what we can do to educate/force these banks to do the correct way. Start a coordinated shitstorm against these banks because of this. Banks (as many companies) are often very concerned about their reputation.
  - wintermutestwin 4y ago
    >Banks (as many companies) are often very concerned about their reputation. Haha. Banks are only concerned about their relative reputation. If all their peers are screwing the consumer, they don't care at all. https://arstechnica.com/tech-policy/2022/10/zelle-fraud-is-on-the-rise-and-many-victims-are-denied-refunds/ https://arstechnica.com/tech-policy/2022/10/zelle-fraud-is-o...
- edent 4y ago
  > I am done with the whole "If not happy, move" That's literally the point of capitalism. Organisations are free to offer any service they like and customers can choose which one best meets their needs. If enough people move to the one offering better 2FA then the others will follow. Having the government force companies to behave in a certain way sounds dangerously close to socialism to me.
lxgr 4y ago
> You live in a free market, so move your business to someone who you think takes security seriously. Adorable. Please show me a bank, utility provider, brokerage, widely-used P2P money transmission service, and phone provider that each offers WebAuthN (without a mandatory fallback to SMS-2FA). There is absolutely no "free market" for authentication methods: Everybody does almost exactly the same thing, as authentication probably does not even make their top 10 business priorities.
- edent 4y ago
  I don't know where in the world you are but... Bank: Most banks in the UK use an industry standard Chip Authentication Program - which uses the bank card's chip rather than SMS 2FA https://en.wikipedia.org/wiki/Chip_Authentication_Program https://en.wikipedia.org/wiki/Chip_Authentication_Program P2P Money: Coinbase https://www.yubico.com/gb/works-with-yubikey/catalog/coinbase/ https://www.yubico.com/gb/works-with-yubikey/catalog/coinbas... Brokerage: Vanguard https://www.yubico.com/gb/works-with-yubikey/catalog/vanguard/ https://www.yubico.com/gb/works-with-yubikey/catalog/vanguar... It would be a bit odd to have a mobile phone provider who doesn't support SMS. But looks like Vodafone is hiring someone with WebAuthN experience https://opportunities.vodafone.com/job/Dusseldforf-Solution-Design-Architect/845003301/ https://opportunities.vodafone.com/job/Dusseldforf-Solution-... Hope that helps.
  - lxgr 4y ago
    > I don't know where in the world you are Ah, your earlier statement ("you live in a free market") implied otherwise. Maybe something worth considering before asserting that there is free market choice in all of these industries.
jabroni_salad 4y ago
Sure, let me just move my brokerage accounts to a provider that supports FIDO. I am sure that is a real thing that the free market has provided or will provide soon. I'm sticking with Schwab for now because they are at least vish resistant. I have a 'verbal passphrase' and support will not help "me" unless I provide it.
- edent 4y ago
  Vanguard offers FIDO https://www.yubico.com/gb/works-with-yubikey/catalog/vanguard/ https://www.yubico.com/gb/works-with-yubikey/catalog/vanguar...
LinuxBender 4y ago
so move your business to someone who you think takes security seriously. That is exactly what I did. I was with a major bank but they would not take my security seriously and only did 2FA. I moved to a small local bank that allowed me to lock down my accounts so that from the internet they are read-only. I have to physically go into the bank and show ID for most of my accounts. That leaves one account I can use for small online purchases. I am working with them to implement better security around ACH/wire transfers. That's not even a discussion I could have with the bigger banks.

by edent 4y ago

seanw444 4y ago

Didn't you hear? Free market's out of style. Goverment mandates and bloated legislation are the new norm.

codegeek 4y ago
Changing banks is not free market just like Changing Insurance Companies. Most banks in US enforce SMS 2FA. I would rather want the choice of not doing SMS 2FA. If you cannot implement better 2FA, dont force me to use SMS 2FA and I assume the risk on my end. That's Free Market.

ghaff 4y ago

You basically need a backup token of some sort. Which, of course, makes them an even tougher sale to a mainstream audience.

hedora 4y ago

For SMS auth, you can get the cell company to re-issue a sim if you lose your phone. This is a feature and a bug, thanks to social engineering attacks. Also, the SMS transport layer isn't secure. With TOTP, you can put the TOTP code in your password manager with all your other passwords, which is probably what I will do it it catches on. It's effectively one factor at that point. (Do you know my password manager's password?)

codegeek 4y ago

"so move your business to someone who you think takes security seriously." For banks, it is not that easy and convenient. I like my banks for many reasons except the 2FA thing. Most banks at least in US are still doing SMS 2FA. I am done with the whole "If not happy, move" and want to figure out what we can do to educate/force these banks to do the correct way.

q-big 4y ago
> I am done with the whole "If not happy, move" and want to figure out what we can do to educate/force these banks to do the correct way. Start a coordinated shitstorm against these banks because of this. Banks (as many companies) are often very concerned about their reputation.
- wintermutestwin 4y ago
  >Banks (as many companies) are often very concerned about their reputation. Haha. Banks are only concerned about their relative reputation. If all their peers are screwing the consumer, they don't care at all. https://arstechnica.com/tech-policy/2022/10/zelle-fraud-is-on-the-rise-and-many-victims-are-denied-refunds/ https://arstechnica.com/tech-policy/2022/10/zelle-fraud-is-o...
edent 4y ago
> I am done with the whole "If not happy, move" That's literally the point of capitalism. Organisations are free to offer any service they like and customers can choose which one best meets their needs. If enough people move to the one offering better 2FA then the others will follow. Having the government force companies to behave in a certain way sounds dangerously close to socialism to me.

lxgr 4y ago

> You live in a free market, so move your business to someone who you think takes security seriously. Adorable. Please show me a bank, utility provider, brokerage, widely-used P2P money transmission service, and phone provider that each offers WebAuthN (without a mandatory fallback to SMS-2FA). There is absolutely no "free market" for authentication methods: Everybody does almost exactly the same thing, as authentication probably does not even make their top 10 business priorities.

edent 4y ago
I don't know where in the world you are but... Bank: Most banks in the UK use an industry standard Chip Authentication Program - which uses the bank card's chip rather than SMS 2FA https://en.wikipedia.org/wiki/Chip_Authentication_Program https://en.wikipedia.org/wiki/Chip_Authentication_Program P2P Money: Coinbase https://www.yubico.com/gb/works-with-yubikey/catalog/coinbase/ https://www.yubico.com/gb/works-with-yubikey/catalog/coinbas... Brokerage: Vanguard https://www.yubico.com/gb/works-with-yubikey/catalog/vanguard/ https://www.yubico.com/gb/works-with-yubikey/catalog/vanguar... It would be a bit odd to have a mobile phone provider who doesn't support SMS. But looks like Vodafone is hiring someone with WebAuthN experience https://opportunities.vodafone.com/job/Dusseldforf-Solution-Design-Architect/845003301/ https://opportunities.vodafone.com/job/Dusseldforf-Solution-... Hope that helps.
- lxgr 4y ago
  > I don't know where in the world you are Ah, your earlier statement ("you live in a free market") implied otherwise. Maybe something worth considering before asserting that there is free market choice in all of these industries.

jabroni_salad 4y ago

Sure, let me just move my brokerage accounts to a provider that supports FIDO. I am sure that is a real thing that the free market has provided or will provide soon. I'm sticking with Schwab for now because they are at least vish resistant. I have a 'verbal passphrase' and support will not help "me" unless I provide it.

edent 4y ago
Vanguard offers FIDO https://www.yubico.com/gb/works-with-yubikey/catalog/vanguard/ https://www.yubico.com/gb/works-with-yubikey/catalog/vanguar...

LinuxBender 4y ago

so move your business to someone who you think takes security seriously. That is exactly what I did. I was with a major bank but they would not take my security seriously and only did 2FA. I moved to a small local bank that allowed me to lock down my accounts so that from the internet they are read-only. I have to physically go into the bank and show ID for most of my accounts. That leaves one account I can use for small online purchases. I am working with them to implement better security around ACH/wire transfers. That's not even a discussion I could have with the bigger banks.