5 ms·
I'm security consultant in the financial industry. I've literally been involved in the decision making on this at a bank. Banks are very conservative, and beh
by eairy 3y ago
I'm security consultant in the financial industry. I've literally been involved in the decision making on this at a bank. Banks are very conservative, and behave like insecure teenagers. They won't do anything bold, they all just copy each other.
I pushed YubiKey as a solution and explained in detail why SMS was an awful choice, but they went with SMS anyway.
It mostly came down to cost. SMS was the cheapest option. YubiKey would involve buying and sending the keys to customers, and they having the pain/cost of supporting them. There was also the feeling that YubiKeys were too confusing for customers. The nail in the coffin was "SMS is the standard solution in the industry" plus "If it's good enough for VISA it's good enough for us".
- heyoni 3y agoBut why won’t banks at least support customer provided yubikeys?
- eru 3y agoBecause it's extra hassle?
- mulmen 3y ago> But why won’t banks at least support customer provided yubikeys? > support You answered your own question.
- heyoni 3y agoAnd that’s the answer isn’t it? Banks are behind the times in terms of security and tech.
- intelVISA 3y agoBanks loathe anything relating, or adjacent, to good SWE principles.
- jalk 3y agoBank of America supports user purchased TOTP devices. https://www.bankofamerica.com/security-center/online-mobile-banking-privacy/usb-security-key/ https://www.bankofamerica.com/security-center/online-mobile-...
- rainbowzootsuit 3y agoBrokerage, not bank, but you can do Yubikey-only at Vanguard. https://www.bogleheads.org/forum/viewtopic.php?t=349826 https://www.bogleheads.org/forum/viewtopic.php?t=349826
- mlrtime 3y agoThe largest US crypto brokerages/exchanges support yubikey. Some will provide and require them for top customers to ensure they are safe.
- ryukoposting 3y agoI'd guess part of the reason is that customers would blame the bank when their YubiKey doesn't work, which would become a nuisance for them as much as the YubiKey's usability issues are a nuisance for the customer.
- dalyons 3y agoI mean your employer wasn’t wrong. Yubikeys ARE way too confusing for the average user, way too easy to lose, etc. maybe have it as an option for power users, but they were right it would be a disastrous default.
- ryukoposting 3y agoInteresting. I assumed a lot of client software for small banks was vendored - I know that's the case for brokerages. Makes it all the weirder that they all imitate each other. Here's the thing about SMS: your great aunt who doesn't know what a JPEG is, knows what a text is. Ok, she might not fully "get it" but she knows where to find a text message in her phone. My tech-literate fiancée struggles to get her YubiKey to work with her phone, and I've tried it with no more luck than she's had. YubiKeys should be supported but they're miles away from being usable enough to totally supplant other 2FA flows.