4 ms·

> Back in Latvia I would just slide my ID card into a USB reader and cryptographically sign the session with a passcode. I think this is a good authentication

> Back in Latvia I would just slide my ID card into a USB reader and cryptographically sign the session with a passcode. I think this is a good authentication model, but it costs money. There is the upfront cost of the physical card, and then the higher cost of lost account recovery. I think that's the turn-off to most banks; they will have to staff a call center that can verify your ID, issue a new card, and then deal with your immediate concerns because you can't access the website. Passwords + security questions are often free, "oh you don't know your password? we'll just email you another one if you remember your first elementary school's name". At the end of the day, they are allowed to cut costs on critical infrastructure (everyone's money!!) because we have a strong victim blaming culture in the US. If your password is guessed, it's because you're bad at picking passwords, not because passwords are an intrinsically flawed technology. If your money is lost, it's because "it's really cool to have transactions that can't be reversed, you should have done your due diligence". It surprises me that everyone is OK with this. (Incidentally, the only place where I've seen the option to use cryptographic authentication is on Vanguard. They added it right about the time we were testing security keys / U2F at Google, and they were the administrator of our 401k plans. I think Google strong-armed them into implementing it! Would love it if they did this to some banks ;)

ljm 3y ago
You’re taking a well-known system, criticising it, and burying the fact you’re from the US well inside of that. We’ve already solved this problem outside of America you know.
diroussel 3y ago
In Norway, Latvia, Belgium and probably others, the card is issued by the government. So there is no cost to the bank to re-issue a lost card.
- jrockway 3y ago
  Ah, that's the key. We'd never get a national ID in the US, instead ironically forcing the costly KYC onto each individual bank. (And Twitter now apparently.)
  - nickserv 3y ago
    There's already a Federal ID required for banking in the US: your social security number.
    - Prickle 3y ago
      Except that when it was first implemented, the government explicitly stated that the Social Security Number was not a valid ID. https://www.npr.org/2018/03/22/596180023/how-social-security-numbers-became-a-form-of-national-identification https://www.npr.org/2018/03/22/596180023/how-social-security... Due to this, it is fundamentally missing multiple levels of security. You can actually guess someone's SSN within 2 digits if you know their date of birth, and location of/hospital of birth.

ljm 3y ago

You’re taking a well-known system, criticising it, and burying the fact you’re from the US well inside of that. We’ve already solved this problem outside of America you know.

diroussel 3y ago

In Norway, Latvia, Belgium and probably others, the card is issued by the government. So there is no cost to the bank to re-issue a lost card.

jrockway 3y ago
Ah, that's the key. We'd never get a national ID in the US, instead ironically forcing the costly KYC onto each individual bank. (And Twitter now apparently.)
- nickserv 3y ago
  There's already a Federal ID required for banking in the US: your social security number.
  - Prickle 3y ago
    Except that when it was first implemented, the government explicitly stated that the Social Security Number was not a valid ID. https://www.npr.org/2018/03/22/596180023/how-social-security-numbers-became-a-form-of-national-identification https://www.npr.org/2018/03/22/596180023/how-social-security... Due to this, it is fundamentally missing multiple levels of security. You can actually guess someone's SSN within 2 digits if you know their date of birth, and location of/hospital of birth.