3 ms·

I'm in the US and both the banks I use do this. It's probably optional but SMS 2FA is a complete joke due to the major security flaws of SMS. Presumably they co

I'm in the US and both the banks I use do this. It's probably optional but SMS 2FA is a complete joke due to the major security flaws of SMS. Presumably they could use a generic 2FA app but then it means they would have to provide technical support to the n-millionth backdoored spyware app that app stores get games to promote which has accountability and compliance implications. Another thing the apps do is instant confirm of suspicious activity and Google Pay which my understanding is keeps card numbers out of store databases that keep getting breached every other month.

mindslight 1y ago
From my perspective all of the "2FA" are nonconsensual steps I'd rather not do, so the easiest options are the least worst. My SMS# for them is a GVoice which goes to my email. Somewhere far down on my todo is a script that just watches for those emails and spits out the code in a terminal for easy pasting. Specifically, Ally, Cap1, BoA, and my local bank all only make me do SMS/email nags at worst. If any of them started pushing trash like expecting to force me to install their app on my actual in-my-pocket-when-out cell-plan phone, I'd drop them like a bad habit. I've never really had a problem with unauthorized transactions, and I'm generally not squeamish about random online retailers (though most seemed to have moved to Shopify, shrug). Generally the most important thing you can do to protect yourself against fraud is review the transactions on your account within 30 days, so any feature that makes it more difficult to do this actually hurts you.
- fluidcruft 1y ago
  Boy I hope your Gmail is never hacked and I also think it's a bit comical that you would build your financial security out of some Rube Goldberg Google service contraption while telling yourself that you're fighting the good fight against Google's encroachment in your life.
  - mindslight 1y ago
    "Financial security" ? Don't you think you're overstating that a bit? We're talking about bank accounts bound by Regulation E, not bearer tokens like cryptocurrency. Traditional bank accounts are quite close to an open ledger - the only thing one really needs to initiate a transaction against an account is the account number, which is printed on every check. As I said, the biggest fraud risk is not checking your accounts every ~30 days. Do this, and your liability is basically capped at having to fill out some paperwork and change account numbers. The "Rube Goldberg contraption" is to mitigate the nonconsensual SMS nag by making it as easy as possible. My login security relies on my passwords. If someone can get those passwords, it means they've pwned my computing infrastructure and I have got much bigger problems than cleaning up unauthorized bank account activity. As for GVoice, I chose to start using it because I saw Google and AT&T as similar attackers. I've stuck with it because it works for more of these types of things than other VOIP providers. With "AI" that original calculus might be changing, and if (when?) I decide to jump away from that then I'll probably move towards something like @rsync's "2FA Mule".
    - fluidcruft 1y ago
      Which banks support 2FA mules?
      - mindslight 1y ago
        I would think all of them, because it's just another prepaid SIM like many people's actual phones. On that front, Ally SMS stopped working with GVoice (I just do the voice call when they want to nag, that still works). And way back I experienced some random issues with Cap1 - it seemed like they were trying to grab the subscriber record as a form of verification (sigh).

mindslight 1y ago

From my perspective all of the "2FA" are nonconsensual steps I'd rather not do, so the easiest options are the least worst. My SMS# for them is a GVoice which goes to my email. Somewhere far down on my todo is a script that just watches for those emails and spits out the code in a terminal for easy pasting. Specifically, Ally, Cap1, BoA, and my local bank all only make me do SMS/email nags at worst. If any of them started pushing trash like expecting to force me to install their app on my actual in-my-pocket-when-out cell-plan phone, I'd drop them like a bad habit. I've never really had a problem with unauthorized transactions, and I'm generally not squeamish about random online retailers (though most seemed to have moved to Shopify, shrug). Generally the most important thing you can do to protect yourself against fraud is review the transactions on your account within 30 days, so any feature that makes it more difficult to do this actually hurts you.

fluidcruft 1y ago
Boy I hope your Gmail is never hacked and I also think it's a bit comical that you would build your financial security out of some Rube Goldberg Google service contraption while telling yourself that you're fighting the good fight against Google's encroachment in your life.
- mindslight 1y ago
  "Financial security" ? Don't you think you're overstating that a bit? We're talking about bank accounts bound by Regulation E, not bearer tokens like cryptocurrency. Traditional bank accounts are quite close to an open ledger - the only thing one really needs to initiate a transaction against an account is the account number, which is printed on every check. As I said, the biggest fraud risk is not checking your accounts every ~30 days. Do this, and your liability is basically capped at having to fill out some paperwork and change account numbers. The "Rube Goldberg contraption" is to mitigate the nonconsensual SMS nag by making it as easy as possible. My login security relies on my passwords. If someone can get those passwords, it means they've pwned my computing infrastructure and I have got much bigger problems than cleaning up unauthorized bank account activity. As for GVoice, I chose to start using it because I saw Google and AT&T as similar attackers. I've stuck with it because it works for more of these types of things than other VOIP providers. With "AI" that original calculus might be changing, and if (when?) I decide to jump away from that then I'll probably move towards something like @rsync's "2FA Mule".
  - fluidcruft 1y ago
    Which banks support 2FA mules?
    - mindslight 1y ago
      I would think all of them, because it's just another prepaid SIM like many people's actual phones. On that front, Ally SMS stopped working with GVoice (I just do the voice call when they want to nag, that still works). And way back I experienced some random issues with Cap1 - it seemed like they were trying to grab the subscriber record as a form of verification (sigh).