5 ms·

Regulators should mandate 2FA with an OTP standard, such as OATH TOTP. Here in EU, lots of banks use their own proprietary OTP-like standard or SMS. I never un

• benoliver999 2y ago
  The readers cost money and people lose them. I still have one for one bank but otherwise it's SMS everywhere. They clearly just don't see it as a realistic threat, on top of all the other security measures in place (for me it's a password, and also a memorable word that isn't typed on the keyboard, then SMS OTP). It's not a great defence of SMS but perfect is the enemy of good, and SMS is just about ok. Most hacking stories I hear about seem to happen through social engineering, where people go to great lengths to authenticate themselves for someone over the phone. One thing that is starting to take hold is banking apps, which once installed can be used to authenticate payment. Again not perfect but better than SMS, and users are increasingly likely to have them installed because of ease of use.
  • nextos 2y ago
    At least here, SIM cloning is a very popular attack.
    • croemer 2y ago
      Where is here? We can't see your geo coordinates :p
      • nextos 2y ago
        As per my parent post, here = EU.
        • jorvi 2y ago
          Maybe your country. You do not speak for all of the EU.
  • toomuchtodo 2y ago
    Passkeys.
    • vishnumohandas 2y ago
      Not a portable format, yet.
      • vdelitz 2y ago
        at most relying parties you can create multiple passkeys, so this is IMO a good solution until portability might be better
      • reginald78 2y ago
        Never will be. Attestation is part of the spec and portability isn't. They are incompatible features.
• etskinner 2y ago
  The reason that SMS is preferred is that "everyone has it". Requiring all customers to get an app is much harder than requiring them to have a phone number than can receive SMS
  • kevincox 2y ago
    "everyone has it" and it is "good enough" at preventing large scale attacks like credential stuffing from data breaches. Most online services aren't so worried about a small number of users being SIM-swapped. They are worried about large numbers of users that reused their password across thousands of sites 5 of which had their database dumped. SMS 2FA isn't about providing individual users a high level of security. It is about providing a baseline level of security for all users.
    • nextos 2y ago
      I disagree. A bank reported ~1,000 SIM swap attacks happened to their clients during 2021 alone in a single EU country. That's a lot. Furthermore, these attacks target high value individuals which I imagine is a particular cause of concern for banks. For this reason, the EU has phased out SMS as a valid 2FA, although not many banks have complied yet. Some banks, like ING, already refuse to send OTPs by SMS and effectively require using an app. SMS is also bad from a user perspective as it turns your phone into a single point of failure. Also, if you are roaming abroad, SMS delivery is usually slow and unreliable. Imagine going to another country and being unable to validate a credit card transaction.
      • t0bia_s 2y ago
        App, that steals my data is no go for me.
        • nextos 2y ago
          I don't like apps either, that's why I'd like standardized 2FA.
  • 2y ago
• t0bia_s 2y ago
  Its easy 2 step verification for making bank transfer. Much more favourable then dedicated bank app for me that steals your data.
• jpalomaki 2y ago
  The main problem with secure device based 2FA is how to handle the case when device gets lost and you don't have backups (many people don't really think this kind of stuff beforehand). How can a person re-establish their identity? For services like Google, Facebook etc. the answer might be "you don't", but it is more difficult for companies where the end user is also the customer. And I think the best answer is government issued digital identity and being able to use that to recover your access to the online services (of course up to you if you wish to make this connection).
  • fmajid 2y ago
    That's why Apple forces you to register two FIDO U2F keys if you use that option for iCloud.
• OptionOfT 2y ago
  The card reader with scanning a barcode is incredibly obtrusive. It requires you to carry the card/bank specific reader with you. So when you're on the go you and want to pay something online with a debit/credit card, you need to whip out the card and the specific reader. And it included that annoying scanning a barcode on screen AND confirming € amount. And the readers had 2 options. Sign and confirm (?). Why they couldn't incorporate this into the barcode? It was all done because it definitely lowered mistakes and was more secure than card number and CVV to pay online.
• cqqxo4zV46cp 2y ago
  This is a terrible, terrible idea. TOTP is secure for nerds but presents very very real security downsides for literally everyone else. Increased popularity of TOTP invites increased frequency of malicious TOTP apps exfiltrating user OTPs. This is pretty much THE reason why it’s quite common to see companies provide TOTP as a hidden, nerdy alternative. Again, if HN got what it wanted as far as tech regulation, the world would be a terrible place, but HN consistently puts nerdy desires ahead of what would actually help wider society.