6 ms·

Bank of New Zealand and Canadian government both issue a 4x4 grid of three character codes and ask for some of them when I login to online services, this prove

Bank of New Zealand and Canadian government both issue a 4x4 grid of three character codes and ask for some of them when I login to online services, this proves the “something I physically have” component of the authentication. I have the grid either on a card or printed off. I like that it doesn’t depend on a phone.

velcrovan 3y ago
Unfortunately the thing they gave you is static and easily reproducible. If infinitely many copies can be made by someone snapping a photo, then the "something you physically have" is no more secure than a second password you have written on a piece of paper.
- applied_heat 3y ago
  If someone breaks in to the locked filing cabinet in my house I have bigger problems than 1 factor being compromised
doubled112 3y ago
Meanwhile, I put the grid in my password manager because I'll never find that paper. Defeats the purpose? Only kind of.
pid-1 3y ago
I've seen some investment banks provide a small device that looks like a calculator and generate MFA codes. Not sure what they are called.
- wlesieutre 3y ago
  RSA SecurID tokens?
- fergbrain 3y ago
  Barclays calls it a PINsentry card reader
- TacticalCoder 3y ago
  > I've seen some investment banks provide a small device that looks like a calculator and generate MFA codes. Not sure what they are called. They're more than MFA codes though: they're actually performing cryptographic challenge/response. I mean: the RSA tokens just generate a MFA code. But the bank "card readers", whether they actually read a card or not, do perform challenge/response. I've got several banks using the same type of card reader: I put my bank card in and respond to a challenge: I enter the digits that the card reader shows me and I can log in. I've got another bank which provided me a reader: it's not a card reader as its standalone (I don't need any bank card to use it) but it still perform challenge/response. For example for any wire tx to a new recipient or above a certain amount, I need to enter the amount and part of the recipient's bank account number and sign the transaction. It's more than just authentication.
- bozhark 3y ago
  Cold wallet
- deleted 3y ago
  [deleted]
rspoerri 3y ago
I got a list of codes when i opened my first online bank account in the early 2000's. In between there was a special key-generator given to each customer, that was abandoned about 10 years ago. (edit: it was the RSA SecurID's mentioned in this thread) Since then we've got apps that need to be activated using a letter with a special qr-code, as well as the bank account-number (username) & password another qr-code from the website. I assume it generates a private key in the app which will not be transferred to a new device (but maybe somehow is). You need to login using your account-number (username) and password, after that you have to open the app (login with face-scan) scan a qr-code and enter the generated code. Getting a printed out card or page with something on it to verify your identity seems like 20 years tech to me.

velcrovan 3y ago

Unfortunately the thing they gave you is static and easily reproducible. If infinitely many copies can be made by someone snapping a photo, then the "something you physically have" is no more secure than a second password you have written on a piece of paper.

applied_heat 3y ago
If someone breaks in to the locked filing cabinet in my house I have bigger problems than 1 factor being compromised

doubled112 3y ago

Meanwhile, I put the grid in my password manager because I'll never find that paper. Defeats the purpose? Only kind of.

pid-1 3y ago

I've seen some investment banks provide a small device that looks like a calculator and generate MFA codes. Not sure what they are called.

wlesieutre 3y ago
RSA SecurID tokens?
fergbrain 3y ago
Barclays calls it a PINsentry card reader
TacticalCoder 3y ago
> I've seen some investment banks provide a small device that looks like a calculator and generate MFA codes. Not sure what they are called. They're more than MFA codes though: they're actually performing cryptographic challenge/response. I mean: the RSA tokens just generate a MFA code. But the bank "card readers", whether they actually read a card or not, do perform challenge/response. I've got several banks using the same type of card reader: I put my bank card in and respond to a challenge: I enter the digits that the card reader shows me and I can log in. I've got another bank which provided me a reader: it's not a card reader as its standalone (I don't need any bank card to use it) but it still perform challenge/response. For example for any wire tx to a new recipient or above a certain amount, I need to enter the amount and part of the recipient's bank account number and sign the transaction. It's more than just authentication.
bozhark 3y ago
Cold wallet
deleted 3y ago
[deleted]

rspoerri 3y ago

I got a list of codes when i opened my first online bank account in the early 2000's. In between there was a special key-generator given to each customer, that was abandoned about 10 years ago. (edit: it was the RSA SecurID's mentioned in this thread) Since then we've got apps that need to be activated using a letter with a special qr-code, as well as the bank account-number (username) & password another qr-code from the website. I assume it generates a private key in the app which will not be transferred to a new device (but maybe somehow is). You need to login using your account-number (username) and password, after that you have to open the app (login with face-scan) scan a qr-code and enter the generated code. Getting a printed out card or page with something on it to verify your identity seems like 20 years tech to me.