4 ms·
Ask HN: Person to person phone authentication system?
I'm looking for a system similar to one that banks use internally for person-to-person phone verification. If a personal banker at a branch calls HQ or another branch, they both pull up a webpage, they both have some set of numbers they exchange and it provides another level of verification they work for the bank.
I have to implement some type of system like this, I don't know what it's even called, I don't know if someone sells this solution, but most importantly: Does anyone know of any OSS solutions to this?
Thanks!! :)
- ahazred8ta 3y agoThis is related to 'mutual authentication' https://en.wikipedia.org/wiki/Mutual_authentication https://en.wikipedia.org/wiki/Mutual_authentication as far as eliminating a man-in-the-middle and confirming identities, but you want to combine this with single-sign-on within an organization. Do you have an internal private chat in your organization? Internal email accounts?
- neom 3y agoYup, you just told me how to solve it, got a good idea now - thank you!! :)
- ahazred8ta 3y agoAh, properly it's out of band authentication (OOBA). Hat tip to /u/Natanael_L on https://reddit.com/r/crypto https://reddit.com/r/crypto , who points out that a bank would want to verify roles / job titles, not just the fact they both have employee userids.
- ahazred8ta 3y agoA recent example of why banks need good authentication: an HK bank employee transferred US$25M based on a videoconference with what looked like his bosses. https://lite.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk/index.html https://lite.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-...
- neom 3y agoYes, and this is only going to get worse, hence businesses are rushing to find solutions (including a few I work with). Frankly, I think there is a startup opportunity there.