5 ms·
Customer service at one of my banks has an official policy of sending me a verification code via email that I then read to them over the phone, and that's not e
by ryukoposting 3y ago
Customer service at one of my banks has an official policy of sending me a verification code via email that I then read to them over the phone, and that's not even close to the most "wrong" 2FA implementation I've ever seen. Somehow that institution knows what a YubiKey is, but several major banks don't.
- Liquix 3y agoFinancial institutions are very slow to adopt new tech. Especially tech that will inevitably cost $$$ in support hours when users start locking themselves out of their accounts. There is little to no advantage to being the first bank to implement YubiKey 2FA. To a risk-averse org, the non-zero chance of a botched rollout or displeased customers outweighs any potential benefit.
- monksy 3y agoThey're pretty terrible when they do. For the longest time the max password size was 8 characters and the csr knew what your password was. Heck I've had Chase security tell me they'd call me back.. dude that's exactly how people get compromised.
- biglost 3y agoA friensd bank, hopefully not the one i use, only allow a password off 6 digits. Yes You read it right, 6 fucking digits to login, i hace him the asvice to run away from that shitty bank
- foepys 3y agoDid this bank start out as a "telephone bank"? One of the largest German consumer banks still does this because they were the first "direct bank" without locations and typing in digits on the telephone pad was the most secure way of authenticating without telling the "bank teller" your password. So it was actually a good security measure but it is apparently too complicated to update their backend to modern standards. They do require 2FA, though.
- asm0dey 3y agoDiBa?
- doubled112 3y agoExactly. 8 character password in the 2010s as the only factor was fine. It was only my money we're talking about. Now I have to wait for an SMS. Great...
- throwaway2990 3y agoSMS is fine on most countries. It’s just America is dumb and allows number transfers to anyone.
- KiwiJohnno 3y agoIts also been a problem in Australia, Optus (2nd biggest teleco) used to allow number porting or activating sim against an existing account with a bare minimum of detail - Like a name, address and date of birth. If you had those details of a target you could clone their SIM and crack any SMS based MFA.
- chris_wot 3y agoIs that alllowed now still?
- throwaway2990 3y agoApparently changed in 2022 to protect consumers.
- eru 3y agoNumber transfers in other countries is also mostly just a question of a bit of social engineering.
- throwaway2990 3y agoNo. Most require some form of identification or matching identification between mobile providers.
- grepfru_it 3y agoUh many banks provide MFA. And secure with hardware keys. It’s just that your level of assets doesn’t warrant that kind of protection. Source: worked at all the major banks, all the wealthy clients use hardware MFA
- heyoni 3y agoThey’re a bank. If they can secure their portals with hardware keys, at least allow customers to onboard their own keys.
- LtWorf 3y agoMy bank gave me an hardware token to protect my 5k€ account. Get better banks people :)
- grepfru_it 3y agoI meant to say in the us. You know how backwards we are here :)
- wsc981 3y agoThe bank I used in The Netherlands provides a MFA device as well. The device requires an ATM card as well to generate a random number. This is the default for all their customers, wealthy or not. https://www.abnamro.nl/en/commercialbanking/internetbanking/e.dentifier/index.html https://www.abnamro.nl/en/commercialbanking/internetbanking/...
- grepfru_it 3y agoI meant to say in the us :)
- darkr 3y ago> There is little to no advantage to being the first bank to implement YubiKey 2FA Ideally they’d just implement passkeys (webauthn/fido). More secure, and it works with iOS, android, 1password, and yubikeys
- krinchan 3y agoJust say BofA.
- snnn 3y agoNot actually. Even if you enabled passkey, you still can login to their phone app via SMS. So it is not more secure. People who knows how to do SMS attacks certainly knows how to install a mobile app. And BofA gave their customers a fake assurance.
- eairy 3y agoI'm security consultant in the financial industry. I've literally been involved in the decision making on this at a bank. Banks are very conservative, and behave like insecure teenagers. They won't do anything bold, they all just copy each other. I pushed YubiKey as a solution and explained in detail why SMS was an awful choice, but they went with SMS anyway. It mostly came down to cost. SMS was the cheapest option. YubiKey would involve buying and sending the keys to customers, and they having the pain/cost of supporting them. There was also the feeling that YubiKeys were too confusing for customers. The nail in the coffin was "SMS is the standard solution in the industry" plus "If it's good enough for VISA it's good enough for us".
- heyoni 3y agoBut why won’t banks at least support customer provided yubikeys?
- eru 3y agoBecause it's extra hassle?
- mulmen 3y ago> But why won’t banks at least support customer provided yubikeys? > support You answered your own question.
- heyoni 3y agoAnd that’s the answer isn’t it? Banks are behind the times in terms of security and tech.
- intelVISA 3y agoBanks loathe anything relating, or adjacent, to good SWE principles.
- jalk 3y agoBank of America supports user purchased TOTP devices. https://www.bankofamerica.com/security-center/online-mobile-banking-privacy/usb-security-key/ https://www.bankofamerica.com/security-center/online-mobile-...
- gonzo41 3y agoBanks are in a tough spot. Remember, banks have you as a customer, they also have a 100 year old person who still wants to come to the branch in person as a customer. Not everyone can grapple with the idea of a Yubikey, or why their bank shouldn't be protecting their money like it did in the past.
- codedokode 3y agoThe problem is that the bank will automatically enable online access and SMS-confirmed transfers for that 100 year old person who doesn't even know how to use Internet.