6 ms·

I like the approach they take in Singapore - take the default posture that users will probably not be security aware and will also reject your advice. Want to

I like the approach they take in Singapore - take the default posture that users will probably not be security aware and will also reject your advice. Want to do login to your bank account? 100% required that you have an two-factor SMS token in addition to your user ID and password. Want to do bill pay to a new-payer? Not only do you need to have your two-factor SMS token to first login, and then make the payment, you also need the physical token they sent you to do a crypto-sign of the bill payer account information before you can add the new bill-payer. Coming from the United States, I'm blown away how much more secure (and convenient - Love bank-bank transfers, haven't used a paper cheque in 2+ years) banking is in Singapore. Probably suggests why paypal probably took off faster in the USA then here as well.

jdimov9 11y ago
Although not 100% required, a lot of this applies to Europe and to the UK in particular. What's a paper cheque?
- tormeh 11y ago
  It's important to note that all this is bank security. Someone else gaining access to your online bank account is a catastrophe, losing control of your Steam account is not. Not to mention your 9gag/genericSite accounts. I mean, nobody wants them anyway. Passwords could be optional for all I care. The only accounts actually worth protecting are bank/government accounts, email and maybe Facebook.
  - danielweber 11y ago
    In the US, banks are required to make you whole for personal accounts if you didn't authorize the transaction. Thus it's in the banks' interest to clamp down on the fraud. Small-businesses need to watch out. They often have significant cash in accounts, are targeted because of that, and don't have the same legal protection.
- michaelt 11y ago
  What's a paper cheque? In some countries, banks give account holders books of banknote-sized paper 'cheques' or 'checks' - you can see pictures at https://en.wikipedia.org/wiki/Cheque https://en.wikipedia.org/wiki/Cheque - they can use for making payments. They have some convenient properties, but poor fraud protection. As such nowerdays they're mostly relegated to applications where fraud isn't a big worry. For example charity donations, payments to friends and family, paying for little johnny's karate lessons, stuff like that. Some utility companies also allow you to pay by mailing in a cheque.
  - hrktb 11y ago
    To add to that, cheques have unique properties that would be hard to replicate. You can preemptively write cheques for future payments, like buying a car in two payments: one now and one in 3 months. It also works for guarantee deposits, or write blank cheques with only the receiver filled in, etc.
    - stephengillie 11y ago
      Not legally - post-dated checks are illegal.
      - jessaustin 11y ago
        Even so, two parties who trust each other can use them without calling the police about it. (Actually a post-dated check is not so much illegal as it is invalid and therefore not intrinsically worth anything.)
      - brobinson 11y ago
        I worked for a major company which operated in all 50 US states about ten years ago which paid me via post-dated checks. I had to wait a few days after receiving my check in the mail before I could deposit it.
      - manarth 11y ago
        They're legit in some countries: https://en.wikipedia.org/wiki/Post-dated_cheque https://en.wikipedia.org/wiki/Post-dated_cheque
deleted 11y ago
[deleted]
currysausage 11y ago
> Want to do login to your bank account? 100% required that you have an two-factor SMS token in addition to your user ID and password. Still leaves the user open to MITM, viruses, and SMS interception. You should take a look at chipTAN [1] [2]. The user has to confirm account number and transfer amount on a little device before the crypto chip on the debit card generates a TAN that is valid only for this specific transaction. I'm not a great fan of German IT (often unimaginative and slow-moving; e.g. none of the major German e-mail providers offer any form of 2FA), but this chipTAN thing is pretty fascinating from a crypto standpoint. [1] https://en.wikipedia.org/wiki/Transaction_authentication_number#chipTAN_.2F_cardTAN https://en.wikipedia.org/wiki/Transaction_authentication_num... [2] https://www.youtube.com/watch?v=LAjLXxrqqK8&t=1m9s https://www.youtube.com/watch?v=LAjLXxrqqK8&t=1m9s
- ghshephard 11y ago
  Yes - the Singapore system uses an offline "signing" physical dongle, in which you enter the account that you would like to use, click "sign", and then enter that information into the website, when you wish to add a new payee. The thing is - once you get used to this system, the "cost" faced by the user goes away. I type in a 2FA a dozen times a day when logging in, and the overhead (wait 3 seconds, type in a 6 digit number in 3 seconds) - is really pretty insignificant.
  - dublinben 11y ago
    Typing a 2FA code a dozen times a day is a pretty significant cost. You might be used to it, but from someone who does this at most once a day, I find it burdensome.
    - reagency 11y ago
      Why would you type a 2FA code when you have bluetooth?
      - dublinben 11y ago
        Why would you trust Bluetooth for anything security related?
mzs 11y ago
Those are good points but I'm not a fan of two factor SMS. It made sense in the day where a cellphone could make calls and do texting and nothing more, but smartphones are used like computers now. Say you have the typical situation with no pin on the phone and password auto-filled by the mobile browser for the site. Now if someone loses that phone, another person can login, looking at history or auto-fill settings for clues. Alternatively, if there is a password for the site, it's either really simple or the password reset request will come in to the mail client on the phone. Since phones are way more than they used to be, for two factor these days it should be a separate dongle that only does the one factor and it is forced to have a pin by the vendor before it can be used. So SMS two-factor is not really all that much better security-wise and it makes it more inconvenient, doubly so for those like me that don't even have a cellphone.
- IceSt0rm 11y ago
  If you are using your phone for the "something you have" factor in 2FA, you should probably have the device secured with a password, pin, etc. That said, you make a good point, if someone has your phone, it's not locked down, and google (or whoever) remembers your password on your phone, then you are screwed. People use phones for the second factor because they are convenient and always with them. I think the solution to the problem you stated above is to use "something you are" (thumprint biometrics) as the second factor of authentication instead of "something you have" (SMS code/mobile authenticator). In the next couple years, most high-end smartphones will probably have thumbprint scanning technology, this seems like a better solution (and more convenient) as you only have to scan your thumb and it'll work as long as you have data, you don't need to worry if you have good cell reception (for SMS).
  - runamok 11y ago
    In most cases you can remotely wipe the compromised device but it will take some small amount of time to do so. You can also de-authorize the device in your password manager, etc.
Anderkent 11y ago
>Want to do login to your bank account? 100% required that you have an two-factor SMS token in addition to your user ID and password. Thing is, if making the choice to have two-factor authentication for the bank is rationally wrong (i.e. the cost of security exceeds the damage of compromise), this isn't actually helping? The point of the article is that users reject security advice for good reason. Forcing them to accept your security advice doesn't help; quite the opposite, it is forcing them to pay the cost of security despite it being not viable. (in this particular example it maybe that the two factor auth is low-friction enough that it 'pays off'. If the article is right, simply giving people the option of two factor auth will have them use it)
- Domenic_S 11y ago
  IME people don't worry too much about 2FA/really secure passwds until they're protecting something they think is valuable. I didn't 2fa my github account for a long long time, despite the ease of use, until I got added to some big projects. Likewise, the average bank member is (speculating here) gonna say, "who wants to steal that $75 in my checking account? not worth it". But an account breach could end up costing a lot more than $75, especially to the bank who has to file insurance claims and do the paperwork, and ofc the time lost to the person who only had $75 to begin with. What I'm trying to say is (I think) that the cost of a bank account breach is hard to measure, because there are a ton of marginal costs associated with it. Locking your credit reports, getting new bank accounts, changing all your autopays, possibly bouncing checks or autopays not going through, filing police reports, filling out claims paperwork, following up on all that, unlocking your credit next time you want to buy a car, etc. Lots and lots of marginal costs in terms of fees and your time.
  - TheCoelacanth 11y ago
    The cost that your security policies inflict on users is also hard to measure.
- perlgeek 11y ago
  > Thing is, if making the choice to have two-factor authentication for the bank is rationally wrong (i.e. the cost of security exceeds the damage of compromise), this isn't actually helping? But it isn't rationally wrong, from the perspective of the bank. The bank isn't paying for the user's time while using 2fa; for the bank the cost is "only" creating and operating the 2fa system. Likewise if you are an ISP or a datacenter operator, security best practices might actually make economic sense, both because of the higher thread and the relatively high stakes.
pdwetz 11y ago
I get what you're saying, but living in a sketchy cell reception area makes me cringe at the thought of requiring SMS (let alone security concerns surrounding SMS as others have already mentioned). A mobile app instead solves it as near as I can tell... assuming you're okay with requiring a mobile device.
- technomancy 11y ago
  Singapore has had 99.99% coverage since 2000 or so... Quite true that lots of things that make sense for them wouldn't work elsewhere.
ggchappell 11y ago
Okay, now I'm wondering about something. A point that Bruce has harped on for years is that the law often creates the wrong incentives for security policies. In particular, in the U.S., the downside of what we call "identity theft" often falls squarely on the consumer, while the security policies for the banking industry are designed by banks. Thus the policy makers may not have to live with the downsides of their own policies. I'm guessing that the incentives created by the law for banking security are rather different in Singapore -- maybe not ideal, but certainly different. Can you (or anyone else) comment knowledgeably on this?
- ghshephard 11y ago
  Government regulation. The MAS (Monetary Authority of Singapore) basically decreed that all financial institutions follow a standard set of (really, really good) guidelines for Internet Banking. Two-Factor authentication and Transaction-Signing by External Token are just a couple of the 182 requirements. http://www.mas.gov.sg/~/media/MAS/Regulations%20and%20Financial%20Stability/Regulatory%20and%20Supervisory%20Framework/Risk%20Management/IBTRM%20Checklist.pdf http://www.mas.gov.sg/~/media/MAS/Regulations%20and%20Financ... For example, check out: Appendix A - "COUNTERING MAN-IN-THE-MIDDLE ATTACKS " It has specific guidance such as "Digital signatures and key-based message authentication codes (KMAC) for payment or fund transfer transactions could be used for the detection of unauthorised modification or injection of transaction data in a middleman attack. For this security solution to work effectively, a customer using a hardware token would need to be able to distinguish the process of generating a one-time password from the process of digitally signing a transaction. What he signs digitally must also be meaningful to him. This means the token should at least explicitly show the payee account number and the payment amount from which a hash value may be derived for the purpose of creating a digital signature. Different crypto keys should be used for generating OTPs and for signing transactions. " The United States (at least the Banks I dealt with) are way behind where Singapore is in terms of Security.

jdimov9 11y ago

Although not 100% required, a lot of this applies to Europe and to the UK in particular. What's a paper cheque?

tormeh 11y ago
It's important to note that all this is bank security. Someone else gaining access to your online bank account is a catastrophe, losing control of your Steam account is not. Not to mention your 9gag/genericSite accounts. I mean, nobody wants them anyway. Passwords could be optional for all I care. The only accounts actually worth protecting are bank/government accounts, email and maybe Facebook.
- danielweber 11y ago
  In the US, banks are required to make you whole for personal accounts if you didn't authorize the transaction. Thus it's in the banks' interest to clamp down on the fraud. Small-businesses need to watch out. They often have significant cash in accounts, are targeted because of that, and don't have the same legal protection.
michaelt 11y ago
What's a paper cheque? In some countries, banks give account holders books of banknote-sized paper 'cheques' or 'checks' - you can see pictures at https://en.wikipedia.org/wiki/Cheque https://en.wikipedia.org/wiki/Cheque - they can use for making payments. They have some convenient properties, but poor fraud protection. As such nowerdays they're mostly relegated to applications where fraud isn't a big worry. For example charity donations, payments to friends and family, paying for little johnny's karate lessons, stuff like that. Some utility companies also allow you to pay by mailing in a cheque.
- hrktb 11y ago
  To add to that, cheques have unique properties that would be hard to replicate. You can preemptively write cheques for future payments, like buying a car in two payments: one now and one in 3 months. It also works for guarantee deposits, or write blank cheques with only the receiver filled in, etc.
  - stephengillie 11y ago
    Not legally - post-dated checks are illegal.
    - jessaustin 11y ago
      Even so, two parties who trust each other can use them without calling the police about it. (Actually a post-dated check is not so much illegal as it is invalid and therefore not intrinsically worth anything.)
    - brobinson 11y ago
      I worked for a major company which operated in all 50 US states about ten years ago which paid me via post-dated checks. I had to wait a few days after receiving my check in the mail before I could deposit it.
    - manarth 11y ago
      They're legit in some countries: https://en.wikipedia.org/wiki/Post-dated_cheque https://en.wikipedia.org/wiki/Post-dated_cheque

deleted 11y ago

[deleted]

currysausage 11y ago

> Want to do login to your bank account? 100% required that you have an two-factor SMS token in addition to your user ID and password. Still leaves the user open to MITM, viruses, and SMS interception. You should take a look at chipTAN [1] [2]. The user has to confirm account number and transfer amount on a little device before the crypto chip on the debit card generates a TAN that is valid only for this specific transaction. I'm not a great fan of German IT (often unimaginative and slow-moving; e.g. none of the major German e-mail providers offer any form of 2FA), but this chipTAN thing is pretty fascinating from a crypto standpoint. [1] https://en.wikipedia.org/wiki/Transaction_authentication_number#chipTAN_.2F_cardTAN https://en.wikipedia.org/wiki/Transaction_authentication_num... [2] https://www.youtube.com/watch?v=LAjLXxrqqK8&t=1m9s https://www.youtube.com/watch?v=LAjLXxrqqK8&t=1m9s

ghshephard 11y ago
Yes - the Singapore system uses an offline "signing" physical dongle, in which you enter the account that you would like to use, click "sign", and then enter that information into the website, when you wish to add a new payee. The thing is - once you get used to this system, the "cost" faced by the user goes away. I type in a 2FA a dozen times a day when logging in, and the overhead (wait 3 seconds, type in a 6 digit number in 3 seconds) - is really pretty insignificant.
- dublinben 11y ago
  Typing a 2FA code a dozen times a day is a pretty significant cost. You might be used to it, but from someone who does this at most once a day, I find it burdensome.
  - reagency 11y ago
    Why would you type a 2FA code when you have bluetooth?
    - dublinben 11y ago
      Why would you trust Bluetooth for anything security related?

mzs 11y ago

Those are good points but I'm not a fan of two factor SMS. It made sense in the day where a cellphone could make calls and do texting and nothing more, but smartphones are used like computers now. Say you have the typical situation with no pin on the phone and password auto-filled by the mobile browser for the site. Now if someone loses that phone, another person can login, looking at history or auto-fill settings for clues. Alternatively, if there is a password for the site, it's either really simple or the password reset request will come in to the mail client on the phone. Since phones are way more than they used to be, for two factor these days it should be a separate dongle that only does the one factor and it is forced to have a pin by the vendor before it can be used. So SMS two-factor is not really all that much better security-wise and it makes it more inconvenient, doubly so for those like me that don't even have a cellphone.

IceSt0rm 11y ago
If you are using your phone for the "something you have" factor in 2FA, you should probably have the device secured with a password, pin, etc. That said, you make a good point, if someone has your phone, it's not locked down, and google (or whoever) remembers your password on your phone, then you are screwed. People use phones for the second factor because they are convenient and always with them. I think the solution to the problem you stated above is to use "something you are" (thumprint biometrics) as the second factor of authentication instead of "something you have" (SMS code/mobile authenticator). In the next couple years, most high-end smartphones will probably have thumbprint scanning technology, this seems like a better solution (and more convenient) as you only have to scan your thumb and it'll work as long as you have data, you don't need to worry if you have good cell reception (for SMS).
- runamok 11y ago
  In most cases you can remotely wipe the compromised device but it will take some small amount of time to do so. You can also de-authorize the device in your password manager, etc.

Anderkent 11y ago

>Want to do login to your bank account? 100% required that you have an two-factor SMS token in addition to your user ID and password. Thing is, if making the choice to have two-factor authentication for the bank is rationally wrong (i.e. the cost of security exceeds the damage of compromise), this isn't actually helping? The point of the article is that users reject security advice for good reason. Forcing them to accept your security advice doesn't help; quite the opposite, it is forcing them to pay the cost of security despite it being not viable. (in this particular example it maybe that the two factor auth is low-friction enough that it 'pays off'. If the article is right, simply giving people the option of two factor auth will have them use it)

Domenic_S 11y ago
IME people don't worry too much about 2FA/really secure passwds until they're protecting something they think is valuable. I didn't 2fa my github account for a long long time, despite the ease of use, until I got added to some big projects. Likewise, the average bank member is (speculating here) gonna say, "who wants to steal that $75 in my checking account? not worth it". But an account breach could end up costing a lot more than $75, especially to the bank who has to file insurance claims and do the paperwork, and ofc the time lost to the person who only had $75 to begin with. What I'm trying to say is (I think) that the cost of a bank account breach is hard to measure, because there are a ton of marginal costs associated with it. Locking your credit reports, getting new bank accounts, changing all your autopays, possibly bouncing checks or autopays not going through, filing police reports, filling out claims paperwork, following up on all that, unlocking your credit next time you want to buy a car, etc. Lots and lots of marginal costs in terms of fees and your time.
- TheCoelacanth 11y ago
  The cost that your security policies inflict on users is also hard to measure.
perlgeek 11y ago
> Thing is, if making the choice to have two-factor authentication for the bank is rationally wrong (i.e. the cost of security exceeds the damage of compromise), this isn't actually helping? But it isn't rationally wrong, from the perspective of the bank. The bank isn't paying for the user's time while using 2fa; for the bank the cost is "only" creating and operating the 2fa system. Likewise if you are an ISP or a datacenter operator, security best practices might actually make economic sense, both because of the higher thread and the relatively high stakes.

pdwetz 11y ago

I get what you're saying, but living in a sketchy cell reception area makes me cringe at the thought of requiring SMS (let alone security concerns surrounding SMS as others have already mentioned). A mobile app instead solves it as near as I can tell... assuming you're okay with requiring a mobile device.

technomancy 11y ago
Singapore has had 99.99% coverage since 2000 or so... Quite true that lots of things that make sense for them wouldn't work elsewhere.

ggchappell 11y ago

Okay, now I'm wondering about something. A point that Bruce has harped on for years is that the law often creates the wrong incentives for security policies. In particular, in the U.S., the downside of what we call "identity theft" often falls squarely on the consumer, while the security policies for the banking industry are designed by banks. Thus the policy makers may not have to live with the downsides of their own policies. I'm guessing that the incentives created by the law for banking security are rather different in Singapore -- maybe not ideal, but certainly different. Can you (or anyone else) comment knowledgeably on this?

ghshephard 11y ago
Government regulation. The MAS (Monetary Authority of Singapore) basically decreed that all financial institutions follow a standard set of (really, really good) guidelines for Internet Banking. Two-Factor authentication and Transaction-Signing by External Token are just a couple of the 182 requirements. http://www.mas.gov.sg/~/media/MAS/Regulations%20and%20Financial%20Stability/Regulatory%20and%20Supervisory%20Framework/Risk%20Management/IBTRM%20Checklist.pdf http://www.mas.gov.sg/~/media/MAS/Regulations%20and%20Financ... For example, check out: Appendix A - "COUNTERING MAN-IN-THE-MIDDLE ATTACKS " It has specific guidance such as "Digital signatures and key-based message authentication codes (KMAC) for payment or fund transfer transactions could be used for the detection of unauthorised modification or injection of transaction data in a middleman attack. For this security solution to work effectively, a customer using a hardware token would need to be able to distinguish the process of generating a one-time password from the process of digitally signing a transaction. What he signs digitally must also be meaningful to him. This means the token should at least explicitly show the payee account number and the payment amount from which a hash value may be derived for the purpose of creating a digital signature. Different crypto keys should be used for generating OTPs and for signing transactions. " The United States (at least the Banks I dealt with) are way behind where Singapore is in terms of Security.