3 ms·

Sorry, I still don't follow. With SMS 2FA the attacker needs strictly more information as compared to just a password. It doesn't matter if you log into your ba

Sorry, I still don't follow. With SMS 2FA the attacker needs strictly more information as compared to just a password. It doesn't matter if you log into your bank account or twitter. Did you mean a TAN for protecting individual transactions? I file this under authorization instead of authentication. But even then a SMS TAN is better than no TAN. I cannot see a scenario where adding SMS authentication makes things less secure.

mindslight 3y ago
You're focusing on an imagined attacker performing a single type of attack, and losing sight of more significant avenues for damage. When talking about the possibility of losing money, the main thing you need to do is check your account transactions within 30 days of being issued a statement. This is required so that you can report unauthorized transactions in a timely manner, so that they can be reversed. Transaction authentication essentially doesn't matter, especially in the consumer market - remember banks are still happily chugging along printing a withdrawal key on the front of every check. Any impediment to verifying your transactions in a timely manner, including for example discontinuing OFX Direct Connect access in the name of "2FA", increases the chance that you might miss the dispute period and actually lose money.
- mr_mitm 3y ago
  Ah, now I get it, thanks for clarifying. Well, this could be solved by sending a notification on all transactions. I already get these for my credit card account (I wish they did this on my checking account, too). When paying with Google Pay, I even get three notifications. This was very useful once, when I woke up to a $50 transaction to the XBox store that I supposedly did while sleeping without even owning an XBox.
  - mindslight 3y ago
    Pragmatically you might be able to find a setting for your bank that lets you notify you of transactions over $X, and then set X to $0.01 or $1.00. Abstractly my larger point is that security isn't a monolithic scalar but rather depends on the threat model and what is being secured. Far too often large entities push out features in the name of "security", but what they really mean is their own security at the expense of yours (eg the TSA). A lot of these pushes (eg SMS 2FA) are like that, especially when made mandatory rather than consensual.

mindslight 3y ago

You're focusing on an imagined attacker performing a single type of attack, and losing sight of more significant avenues for damage. When talking about the possibility of losing money, the main thing you need to do is check your account transactions within 30 days of being issued a statement. This is required so that you can report unauthorized transactions in a timely manner, so that they can be reversed. Transaction authentication essentially doesn't matter, especially in the consumer market - remember banks are still happily chugging along printing a withdrawal key on the front of every check. Any impediment to verifying your transactions in a timely manner, including for example discontinuing OFX Direct Connect access in the name of "2FA", increases the chance that you might miss the dispute period and actually lose money.

mr_mitm 3y ago
Ah, now I get it, thanks for clarifying. Well, this could be solved by sending a notification on all transactions. I already get these for my credit card account (I wish they did this on my checking account, too). When paying with Google Pay, I even get three notifications. This was very useful once, when I woke up to a $50 transaction to the XBox store that I supposedly did while sleeping without even owning an XBox.
- mindslight 3y ago
  Pragmatically you might be able to find a setting for your bank that lets you notify you of transactions over $X, and then set X to $0.01 or $1.00. Abstractly my larger point is that security isn't a monolithic scalar but rather depends on the threat model and what is being secured. Far too often large entities push out features in the name of "security", but what they really mean is their own security at the expense of yours (eg the TSA). A lot of these pushes (eg SMS 2FA) are like that, especially when made mandatory rather than consensual.