3 ms·

Banks have no clue about 2FA/ MFA, they will happily put the bank app and the custom TOTP generator/ "key"-app on the same phone or, as a fallback, send SMS to

Banks have no clue about 2FA/ MFA, they will happily put the bank app and the custom TOTP generator/ "key"-app on the same phone or, as a fallback, send SMS to the same phone the bank app is on. So in reality, it's at best 1.5FA because when the phone is owned, the user already lost. And it is really hard to not have the banking app on the phone with many institutions. Some institutions now put the TOTP generation into the same app too. Oh and there are limits on the user name and password-length that make it easier for attackers to crack, in some cases (in Germany) the password can be exactly 5 characters long and the username tends to be the debit card number by default. In many ways, this is really cumbersome, not really secure and on top of everything else adding a false sense of security. Less advanced customers are either somewhat secure but then the product is barely usable or they can realistically use the service but the security is so-so.

vladvasiliu 3y ago
> Banks have no clue about 2FA/ MFA, they will happily put the bank app and the custom TOTP generator/ "key"-app on the same phone or, as a fallback, send SMS to the same phone the bank app is on. This. My bank in France, BNP, does that. Every so often, when I connect to the app on the phone, it says something similar to "in accordance with <some regulation> a strong authentication must be made every <number> of sign-ins". You're presented with only one button that says something like "ok". You press it, and you're in business. This is after requiring me to type in my pin, which must be precisely 6 digits, and some sequences are forbidden, so you can't type 1234 or similar. It doesn't seem to interact with the secure enclave in any way. If this number of sign-ins is reached while I'm on a PC (which is the most likely), it'll send a confirmation request on the phone, so at least it works there. When paying online, I'll also get a confirmation request on the phone app. On my professional account, with the same bank, the situation used to be exactly the same. But a few months ago, they switched away from that to sending a confirmation code via SMS for bank transfers. Credit card payments still have the app confirmation request.
usrusr 3y ago
They do? My bank is very explicit about "don't ever run the front-end and the second factor on the same device". Perhaps it's a German thing, with all our Datenschutz fundamentalism that will happily consider even IP addresses PII?
- kaliszad 3y ago
  My experience is with select German and Czech banks and/ or "Sparkasse" which is a kind of savings bank used very often by private citizens. These tend to have better mortgage options in some cases but are quickly inconvenient if you have an unusual (digital/ SaaS) business or any kind of special requirements, like if you want to transfer larger sums of money into other countries with a decent exchange rate. > "don't ever run the front-end and the second factor on the same device" This is required in some cases, probably unless you apply for the physical hardware token generator which costs extra. You must apply for the 2FA-app initialization through the banking app that you are supposed to run on the same phone. In both cases, it is basically impossible to have a backup. Also, the banking app and the banking key app are supposed to have a separate PIN/ short password or a biometric login. Of course, the biometric approach has all kinds of problems in legal challenges (e.g. something you know is protected differently to something you are). Also, something you know cannot be easily obtained while you are asleep. Also, you probably don't want to use your password manager on your mobile phone - so there you are, typing a generated password to log into the key/ 2FA app for security theater. If there wasn't the banking app right next to the key app, the bank could probably just use something like FreeOTP+ or Google Authenticator without reinventing the wheel, also enabling backups in the process and skipping sending physical mail with the initial setup tokens. But that would be too straight forward and not "enterprise" security or whatever. The situation in Czechia is more or less similar. The banks tend to belong to the same banking groups so the underlying infrastructure might be similar even though Czechia still does not have the Euro/ SEPA.
threeseed 3y ago
> Banks have no clue about 2FA/ MFA Of course they do. But they need to balance security with end user experience. And since security for a bank is about risk management they can offset this risk in other areas to compensate e.g. additional processes for activities involving larger amounts of money.
wkat4242 3y ago
My bank wants me to type a code received in the app into a number field a little bit lower on the screen in the same app. They consider this a second factor. Of course it's nothing but busywork and security theater.

vladvasiliu 3y ago

> Banks have no clue about 2FA/ MFA, they will happily put the bank app and the custom TOTP generator/ "key"-app on the same phone or, as a fallback, send SMS to the same phone the bank app is on. This. My bank in France, BNP, does that. Every so often, when I connect to the app on the phone, it says something similar to "in accordance with <some regulation> a strong authentication must be made every <number> of sign-ins". You're presented with only one button that says something like "ok". You press it, and you're in business. This is after requiring me to type in my pin, which must be precisely 6 digits, and some sequences are forbidden, so you can't type 1234 or similar. It doesn't seem to interact with the secure enclave in any way. If this number of sign-ins is reached while I'm on a PC (which is the most likely), it'll send a confirmation request on the phone, so at least it works there. When paying online, I'll also get a confirmation request on the phone app. On my professional account, with the same bank, the situation used to be exactly the same. But a few months ago, they switched away from that to sending a confirmation code via SMS for bank transfers. Credit card payments still have the app confirmation request.

usrusr 3y ago

They do? My bank is very explicit about "don't ever run the front-end and the second factor on the same device". Perhaps it's a German thing, with all our Datenschutz fundamentalism that will happily consider even IP addresses PII?

kaliszad 3y ago
My experience is with select German and Czech banks and/ or "Sparkasse" which is a kind of savings bank used very often by private citizens. These tend to have better mortgage options in some cases but are quickly inconvenient if you have an unusual (digital/ SaaS) business or any kind of special requirements, like if you want to transfer larger sums of money into other countries with a decent exchange rate. > "don't ever run the front-end and the second factor on the same device" This is required in some cases, probably unless you apply for the physical hardware token generator which costs extra. You must apply for the 2FA-app initialization through the banking app that you are supposed to run on the same phone. In both cases, it is basically impossible to have a backup. Also, the banking app and the banking key app are supposed to have a separate PIN/ short password or a biometric login. Of course, the biometric approach has all kinds of problems in legal challenges (e.g. something you know is protected differently to something you are). Also, something you know cannot be easily obtained while you are asleep. Also, you probably don't want to use your password manager on your mobile phone - so there you are, typing a generated password to log into the key/ 2FA app for security theater. If there wasn't the banking app right next to the key app, the bank could probably just use something like FreeOTP+ or Google Authenticator without reinventing the wheel, also enabling backups in the process and skipping sending physical mail with the initial setup tokens. But that would be too straight forward and not "enterprise" security or whatever. The situation in Czechia is more or less similar. The banks tend to belong to the same banking groups so the underlying infrastructure might be similar even though Czechia still does not have the Euro/ SEPA.

threeseed 3y ago

> Banks have no clue about 2FA/ MFA Of course they do. But they need to balance security with end user experience. And since security for a bank is about risk management they can offset this risk in other areas to compensate e.g. additional processes for activities involving larger amounts of money.

wkat4242 3y ago

My bank wants me to type a code received in the app into a number field a little bit lower on the screen in the same app. They consider this a second factor. Of course it's nothing but busywork and security theater.