3 ms·

> This reminds me of the banks that offer TOTP with fallback to SMS - just turns the "security improvement" into a waste of time and effort. Not really. TOTP i

by jorvi 3y ago

> This reminds me of the banks that offer TOTP with fallback to SMS - just turns the "security improvement" into a waste of time and effort. Not really. TOTP is mostly there to protect against password leakage, be it through shoulder peeking or digital means. The SMS fallback still protects against all of these. A shoulder peeker can't read your texts if your phone is on default security, as message contents are not displayed on a lock screen without some form of unlock. The digital attacker will need to remotely clone your SIM or do a SS7 attack, both which are out of the realm for 99.9% of attackers. And if you are truly at risk for this, you are important enough for the bank to have setup additional measures. You will now probably bring up auth attacks via fake websites, but a TOTP doesn't protect against these. Only passkeys and physical keys do, and by far most banks don't yet support either :)

rvnx 3y ago
Call the phone operator: "I need a new simcard, I recently moved, can you send me one ? - yes yes no problems."
- jorvi 3y ago
  Considering you have to PIN €0.01 at the door, and the bank account has to match the bank account attached to the provider account, another virtually impossible attack :) Unless someone has stolen your bank card and knows your PIN, in which case you have bigger problems.
hnbear 3y ago
TOTP is also vulnerable to good phishing attackes. You can convince someone to enter their creds and OTP code, which can be used remotely. The value of the Yubi is that you need it physically, which can't be accomplished via phishing and other remote attacks. Physical theft is much, much rarer, and if a laptop with Yubi in it is stolen the thief won't have your user/pass (unless it's on a sticky in your bag, etc). It's a very, very targeted attack if they phish your creds, then come steal your laptop, and you need more advanced protections than a yubi.

by jorvi 3y ago

rvnx 3y ago

Call the phone operator: "I need a new simcard, I recently moved, can you send me one ? - yes yes no problems."

jorvi 3y ago
Considering you have to PIN €0.01 at the door, and the bank account has to match the bank account attached to the provider account, another virtually impossible attack :) Unless someone has stolen your bank card and knows your PIN, in which case you have bigger problems.

hnbear 3y ago

TOTP is also vulnerable to good phishing attackes. You can convince someone to enter their creds and OTP code, which can be used remotely. The value of the Yubi is that you need it physically, which can't be accomplished via phishing and other remote attacks. Physical theft is much, much rarer, and if a laptop with Yubi in it is stolen the thief won't have your user/pass (unless it's on a sticky in your bag, etc). It's a very, very targeted attack if they phish your creds, then come steal your laptop, and you need more advanced protections than a yubi.