6 ms·

My main bank uses username + password + (random subset of ‘memorable word but actually unencrypted password’ driven by select boxes), then 2FA on top, and it li

• vidarh 3y ago
  I'm Norwegian, but have lived in the UK since 2000, so I've seen the evolution step by step, and UK banks have pretty much just kept adding new steps every time fraud got too bad instead of rethinking things properly. It's infuriating. Norway has a near universal electronic signature solution not quite the same as your Latvian one but sounds similar-ish (and there's a EU/EEA requirement to require mutual recognition at some point) and it feels much better (e.g. the Norwegian ones allow access to government websites as well, and can be used to sign contracts etc. - I'm assuming the Latvian one has similar options).
  • ljm 3y ago
    Yeah your ID in Latvia has an electronic certificate for governments, banks, etc
• williamcotton 3y ago
  I’m so envious of the Baltic’s use of technology at the institutional level. It seems literally infeasible for the United States to have state-issued PKI. It’s a meta-partisan issue: no side trusts the other to manage crypto or computer systems. So for example instead of a public many-to-many digital publishing platform we are stuck with the whims of grown men who want to fist fight each other in the Colosseum and all because every X is convinced every Y is so despicable and corrupt that such a public system would be much worse than what we have now.
  • NavinF 3y ago
    tbh I can't think of many cases where I'd want state-issued PKI. I already use public key crypto secured by biometrics (faceid) to make payments, login to my bank, etc. None of that requires interacting with the state. For most normal computer use I quite like how random social media sites can't demand my identity because it'd be too expensive for them to verify it using public records.
  • labster 3y ago
    The USA was distrustful of national ID cards decades before the current level of hyperpartisan rancor. We just don’t the government enough to let them track us everywhere. Not that the current climate helps. The REAL ID Act of 2005 has been delayed so many times, now to 2025. Maybe we should just repeal it instead.
    • xp84 3y ago
      > We just don’t the government enough to let them track us everywhere. That statement is both true and emblematic of the problem. Everyone is so cynical that a clean public-key, offline, certificate-based solution, with an absolute zero visibility to the government of who is doing what, would always be assumed to be part of some nefarious Illuminati/Democrat/Republican plot. Proving it to people with technical tests wouldn't prove it. They'll always be convinced. What we need from the government is so minimal really, just to sign certificates if we prove our identity. But it'll never happen in the US due to the distrust situation.
      • jimmydorry 3y ago
        Because there has never been a proposal for a "clean public-key / offline / certificate-based solution". It's always a central database that also does x and y and will be available for w and z departments to do as they will with it.
        • xp84 3y ago
          It doesn’t matter though, because the percentage of Americans who can understand public key crypto even in a vague way sufficient to critically read a technical analysis and judge it to be true, you could count on one hand. Nobody has proposed it because if any politicians have seen such a proposal on their desks, even if they themselves grasp it (unlikely), they know most Americans would freak out on principle.
• plorntus 3y ago
  Spains banks (I’ve used two so far) simply use your ID number which is used in a lot of places and not considered secret and enforces a 4 digit password. It’s an absolute joke.
  • ljm 3y ago
    Most banks in Spain require physical presence in the branch for 2fa
    • mooreds 3y ago
      You mean to set up a second factor, they require you to go into a branch?
  • deepsun 3y ago
    Bank Of America requires to tell them a 2FA code sent over SMS, when SMS literally says: <#>BofA: DO NOT share this code. We will NEVER call you or text you for it. No, it wasn't scam, seen that process physically visiting a branch on agent's display multiple times.
    • photonerd 3y ago
      My bank does that for in person visits but you key in the code on a PoS style keypad at their desk
  • illusiveman 3y ago
    I wondered once about this, but it kind of make sense from the point of view of usability. Unlike any webservice, you usually have very few attempts to make a successful login before getting locked out, so even if it's four digits, the odds of a successful brute force attack are very low
    • plorntus 3y ago
      I suppose so, I just find it funny really that my bank has less password requirements than most (if not all) online services I use
• jrockway 3y ago
  > Back in Latvia I would just slide my ID card into a USB reader and cryptographically sign the session with a passcode. I think this is a good authentication model, but it costs money. There is the upfront cost of the physical card, and then the higher cost of lost account recovery. I think that's the turn-off to most banks; they will have to staff a call center that can verify your ID, issue a new card, and then deal with your immediate concerns because you can't access the website. Passwords + security questions are often free, "oh you don't know your password? we'll just email you another one if you remember your first elementary school's name". At the end of the day, they are allowed to cut costs on critical infrastructure (everyone's money!!) because we have a strong victim blaming culture in the US. If your password is guessed, it's because you're bad at picking passwords, not because passwords are an intrinsically flawed technology. If your money is lost, it's because "it's really cool to have transactions that can't be reversed, you should have done your due diligence". It surprises me that everyone is OK with this. (Incidentally, the only place where I've seen the option to use cryptographic authentication is on Vanguard. They added it right about the time we were testing security keys / U2F at Google, and they were the administrator of our 401k plans. I think Google strong-armed them into implementing it! Would love it if they did this to some banks ;)
  • ljm 3y ago
    You’re taking a well-known system, criticising it, and burying the fact you’re from the US well inside of that. We’ve already solved this problem outside of America you know.
  • diroussel 3y ago
    In Norway, Latvia, Belgium and probably others, the card is issued by the government. So there is no cost to the bank to re-issue a lost card.
    • jrockway 3y ago
      Ah, that's the key. We'd never get a national ID in the US, instead ironically forcing the costly KYC onto each individual bank. (And Twitter now apparently.)
• RulerOf 3y ago
  > random subset of ‘memorable word but actually unencrypted password’ This annoys me so much with my bank. Their app lets you enroll your account into Face ID authentication, then still ask one of the recovery questions every time. The UX is awful. I'm so convinced that complaining anywhere won't actually help so I don't bother. I'd love to know what the hypothetical attack scenario is that drove that decision, but I suspect there isn't one, and the app saves the username/password in encrypted device storage.
  • jimmaswell 3y ago
    The more crap they shove in, the more some manager can boast about "improving security". And no one in the company wants to be the one saying no to "more security" so no one pushes back.
• NikkiA 3y ago
  My 'UK' bank recently dropped using the password completely, likely because someone pointed out to them that since you could simply reset the password via the SMS 2FA, it was essentially pointless. So now the SMS and a 5 digit PIN are all it takes. Eventually they'll figure out that the PIN can be reset via 'just an SMS' too. 'security'
• lozenge 3y ago
  I was about to tell you to switch banks, then I realised you just described my bank. Yeah, I don't understand why none of the mobile-friendly banks are willing to build even a basic web interface for use on the big screen.
• timtom39 3y ago
  In Latvia what happens if you lose your ID?