8 ms·

As the parent pointed out, banks don't care about customer access or even customer security per se. They care about not getting fined or accused of not being "a

As the parent pointed out, banks don't care about customer access or even customer security per se. They care about not getting fined or accused of not being "as secure as possible." You and I know that using SMS for 2FA is a non-great idea. Banks mostly know it too. The reason they continue to use it is because regulators will not ding them for using it, and there's currently no better alternative that the average muggle customer can handle.

bayindirh 3y ago
One of the banks I work with had 2FA fobs since the beginning of 2000s. Now they have the same "fob" as an app in the phone, and using it is mandatory IIRC. Most banks lock your phone access to your IMEI + phone model + some phone specific data, so people knowing your details can't login without your phone. Web side needs 2FA or special activation depending on the bank. Forgot your password? You need your biometric ID and your actual face to match at that very moment to make that work. These are by regulations, yes, but this is very far from a "security theater".
- happymellon 3y ago
  I think the parent posts meant that whoever reviews your banks 2FA should say "that is good" would also look at the SMS system and say "that is good". If they are only doing it to tick compliance boxes then there is probably not much motivation to do it better. Those systems are security theatre.
  - bayindirh 3y ago
    Yes, I understood what the parent post tried to say, and just wanted to provide a counter example which is not a security theater in its nature. Ah, also the same bank doesn't send SMS anmymore. Everything arrives to their app. Only they fallback to SMS if the app fails to acknowledge receiving the notification, which happens once a year? Also, banks do not mail financial information by default to prevent wiretapping by 3rd parties.
    - efreak 3y ago
      How does wiretapping affect mail?
      - bayindirh 3y ago
        Email, unless you encrypt it yourself, is not encrypted at rest. This means any mail server or relay which your email lands on can be openly mined and analyzed transparently, and without any evidence (which is how GMail works, BTW). If you're sending sensitive financial information over the mail, it can be read, classified, tied to you and be used against you if required. So, we have a directive to not email anything financial to the recipient by default.

bayindirh 3y ago

One of the banks I work with had 2FA fobs since the beginning of 2000s. Now they have the same "fob" as an app in the phone, and using it is mandatory IIRC. Most banks lock your phone access to your IMEI + phone model + some phone specific data, so people knowing your details can't login without your phone. Web side needs 2FA or special activation depending on the bank. Forgot your password? You need your biometric ID and your actual face to match at that very moment to make that work. These are by regulations, yes, but this is very far from a "security theater".

happymellon 3y ago
I think the parent posts meant that whoever reviews your banks 2FA should say "that is good" would also look at the SMS system and say "that is good". If they are only doing it to tick compliance boxes then there is probably not much motivation to do it better. Those systems are security theatre.
- bayindirh 3y ago
  Yes, I understood what the parent post tried to say, and just wanted to provide a counter example which is not a security theater in its nature. Ah, also the same bank doesn't send SMS anmymore. Everything arrives to their app. Only they fallback to SMS if the app fails to acknowledge receiving the notification, which happens once a year? Also, banks do not mail financial information by default to prevent wiretapping by 3rd parties.
  - efreak 3y ago
    How does wiretapping affect mail?
    - bayindirh 3y ago
      Email, unless you encrypt it yourself, is not encrypted at rest. This means any mail server or relay which your email lands on can be openly mined and analyzed transparently, and without any evidence (which is how GMail works, BTW). If you're sending sensitive financial information over the mail, it can be read, classified, tied to you and be used against you if required. So, we have a directive to not email anything financial to the recipient by default.