4 ms·

The biggest problem is banking system. "Don't want - no bank for you". That's the problem.

by zx8080 5mo ago

Hackbraten 5mo ago
Let them know. Write a letter to the CEO. And vote with your wallet and switch banks if you can. There's always a bank willing to offer you a non-app 2FA scheme.
- brabel 5mo ago
  Do you think banks are using attestation gratuitously? It helps prevent a lot of fraud. You are opposing something that saves people’s savings every day just because you think it takes “freedom” away from a few hobbyists. Do you even have a phone that does not support hardware attestation or is all this posturing about something hypothetical?
  - Hackbraten 5mo ago
    > Do you think banks are using attestation gratuitously? What I'm claiming is that banks have the freedom of offering their customers 2FA other than smartphone apps. > Do you even have a phone that does not support hardware attestation or is all this posturing about something hypothetical? All the phones I own, including my daily driver, run some flavor of Debian. None of them support hardware attestation. I'm in Europe, bound by PSD2, and own a couple of cheap, certified chip-and-TAN devices so I can do banking.
  - xinayder 5mo ago
    Can you show me examples where locking down an OS has prevented fraud in banking? Honestly, if the only way to secure your banking system is by locking down users' devices, there is something really bad going on at your end, security-wise. Your system should be secure even without locking down user hardware.
    - Hackbraten 5mo ago
      One of the threat models is that a fraudster tricks a non-technical user into installing malware, which then manipulates the user interface so that next time the user tries to send money to Bob, it actually goes to Mallory. That's a legitimate concern, and one of the causes why PSD2 mandates that all 2FA devices must have a display that shows the user where they're about to send the money and how much.
      - 63stack 5mo ago
        And one of the threat models that police use in the US is tracking women suspected of going for abortions through the use of road cameras, and other surveillance methods. Once you have the attestation in place you have no guarantee who is going to get access to data like what apps are present on your device, and there will be nothing you can do to stop it. Meanwhile, we could educate people against common scams. How is this not just trading one smaller bad for a bigger bad? Why is this touted as an improvement?
        Hackbraten 5mo ago
        That's why I'm strongly against remote attestation of general-purpose hardware. I use a handheld card reader with a display as a 2FA for my bank transactions. It shows me the transaction and, after I confirm, sends a TAN to the bank. It is not a general-purpose device but a certified, tamper-evident/-resistant black box that does just that one thing. > Meanwhile, we could educate people against common scams. There's a million ways you can get scammed, no matter how many hours of training you've had.
        axus 5mo ago
        You can't educate (many) people against common scams. But people should have the freedom to opt out of surveillance in their private lives, at the risk of exposure to scams.
        63stack 5mo ago
        I don't see why we couldn't have both better education around this, and the freedom to opt out of surveillance
- gorgolo 5mo ago
  Banks don’t do this because of profit. They do it because of decades of laws pushing in this direction. Anti-money laundering, know your customer, digitalised currency, abandoning cash, preventing tax evasion etc… it’s been getting more extensive over time.
  - Hackbraten 5mo ago
    None of the things you mentioned inherently require the user to own (and babysit) an expensive general-purpose computing device produced by tracking-obsessed adtech giants and with software obsolescence built into the product.
- locknitpicker 5mo ago
  > Let them know. Write a letter to the CEO. I think you're naively presuming the issue is simple and easy to address with a letter. Regardless of your bank, payment systems such as Visa and Mastercard have blocked transactions involving mainstream online stores such as Steam because they unilaterally deemed some games to be problematic. You cannot fix this problem with an email.
  - Hackbraten 5mo ago
    These are two unrelated problems. One is "payment systems use imperfect heuristics in their own operations to fulfil their regulatory obligations." The problem I was referring to is "banks push 2FA onto end users but are unwilling to give them alternatives that don't involve meddling with the user's own most private and expensive device." The latter is absolutely a thing where customers can (and should IMO) push back hard.
    - locknitpicker 5mo ago
      > These are two unrelated problems. One is "payment systems use imperfect heuristics in their own operations to fulfil their regulatory obligations." No, they are not. You have people reliant on this software infrastructure for very basic aspects of their life such using their own money to buying whatever they feel like buying, and you have people being deprived of their rights because operators of said infrastructure actively prevent and deny their rights to do so. This has nothing to do with heuristics, and everything to do with granting people the power to dictate what you may or may not do with the things you own.
- iso1631 5mo ago
  > vote with your wallet This does not work. You aren't talking about pissing off a significant percentage of the users who go elsewhere. The imbalance in power is unthinkable to people 100 years ago when the phrase was first popularised.

The biggest problem is banking system. "Don't want - no bank for you". That's the problem.

by zx8080 5mo ago

The biggest problem is banking system. "Don't want - no bank for you". That's the problem.

Let them know. Write a letter to the CEO. And vote with your wallet and switch banks if you can. There's always a bank willing to offer you a non-app 2FA scheme.

brabel 5mo ago
Do you think banks are using attestation gratuitously? It helps prevent a lot of fraud. You are opposing something that saves people’s savings every day just because you think it takes “freedom” away from a few hobbyists. Do you even have a phone that does not support hardware attestation or is all this posturing about something hypothetical?
- Hackbraten 5mo ago
  > Do you think banks are using attestation gratuitously? What I'm claiming is that banks have the freedom of offering their customers 2FA other than smartphone apps. > Do you even have a phone that does not support hardware attestation or is all this posturing about something hypothetical? All the phones I own, including my daily driver, run some flavor of Debian. None of them support hardware attestation. I'm in Europe, bound by PSD2, and own a couple of cheap, certified chip-and-TAN devices so I can do banking.
- xinayder 5mo ago
  Can you show me examples where locking down an OS has prevented fraud in banking? Honestly, if the only way to secure your banking system is by locking down users' devices, there is something really bad going on at your end, security-wise. Your system should be secure even without locking down user hardware.
  - Hackbraten 5mo ago
    One of the threat models is that a fraudster tricks a non-technical user into installing malware, which then manipulates the user interface so that next time the user tries to send money to Bob, it actually goes to Mallory. That's a legitimate concern, and one of the causes why PSD2 mandates that all 2FA devices must have a display that shows the user where they're about to send the money and how much.
    - 63stack 5mo ago
      And one of the threat models that police use in the US is tracking women suspected of going for abortions through the use of road cameras, and other surveillance methods. Once you have the attestation in place you have no guarantee who is going to get access to data like what apps are present on your device, and there will be nothing you can do to stop it. Meanwhile, we could educate people against common scams. How is this not just trading one smaller bad for a bigger bad? Why is this touted as an improvement?
      - Hackbraten 5mo ago
        That's why I'm strongly against remote attestation of general-purpose hardware. I use a handheld card reader with a display as a 2FA for my bank transactions. It shows me the transaction and, after I confirm, sends a TAN to the bank. It is not a general-purpose device but a certified, tamper-evident/-resistant black box that does just that one thing. > Meanwhile, we could educate people against common scams. There's a million ways you can get scammed, no matter how many hours of training you've had.
      - axus 5mo ago
        You can't educate (many) people against common scams. But people should have the freedom to opt out of surveillance in their private lives, at the risk of exposure to scams.
        63stack 5mo ago
        I don't see why we couldn't have both better education around this, and the freedom to opt out of surveillance
gorgolo 5mo ago
Banks don’t do this because of profit. They do it because of decades of laws pushing in this direction. Anti-money laundering, know your customer, digitalised currency, abandoning cash, preventing tax evasion etc… it’s been getting more extensive over time.
- Hackbraten 5mo ago
  None of the things you mentioned inherently require the user to own (and babysit) an expensive general-purpose computing device produced by tracking-obsessed adtech giants and with software obsolescence built into the product.
locknitpicker 5mo ago
> Let them know. Write a letter to the CEO. I think you're naively presuming the issue is simple and easy to address with a letter. Regardless of your bank, payment systems such as Visa and Mastercard have blocked transactions involving mainstream online stores such as Steam because they unilaterally deemed some games to be problematic. You cannot fix this problem with an email.
- Hackbraten 5mo ago
  These are two unrelated problems. One is "payment systems use imperfect heuristics in their own operations to fulfil their regulatory obligations." The problem I was referring to is "banks push 2FA onto end users but are unwilling to give them alternatives that don't involve meddling with the user's own most private and expensive device." The latter is absolutely a thing where customers can (and should IMO) push back hard.
  - locknitpicker 5mo ago
    > These are two unrelated problems. One is "payment systems use imperfect heuristics in their own operations to fulfil their regulatory obligations." No, they are not. You have people reliant on this software infrastructure for very basic aspects of their life such using their own money to buying whatever they feel like buying, and you have people being deprived of their rights because operators of said infrastructure actively prevent and deny their rights to do so. This has nothing to do with heuristics, and everything to do with granting people the power to dictate what you may or may not do with the things you own.
iso1631 5mo ago
> vote with your wallet This does not work. You aren't talking about pissing off a significant percentage of the users who go elsewhere. The imbalance in power is unthinkable to people 100 years ago when the phrase was first popularised.