4 ms·

> Want to do login to your bank account? 100% required that you have an two-factor SMS token in addition to your user ID and password. Still leaves the user op

> Want to do login to your bank account? 100% required that you have an two-factor SMS token in addition to your user ID and password. Still leaves the user open to MITM, viruses, and SMS interception. You should take a look at chipTAN [1] [2]. The user has to confirm account number and transfer amount on a little device before the crypto chip on the debit card generates a TAN that is valid only for this specific transaction. I'm not a great fan of German IT (often unimaginative and slow-moving; e.g. none of the major German e-mail providers offer any form of 2FA), but this chipTAN thing is pretty fascinating from a crypto standpoint. [1] https://en.wikipedia.org/wiki/Transaction_authentication_number#chipTAN_.2F_cardTAN https://en.wikipedia.org/wiki/Transaction_authentication_num... [2] https://www.youtube.com/watch?v=LAjLXxrqqK8&t=1m9s https://www.youtube.com/watch?v=LAjLXxrqqK8&t=1m9s

ghshephard 11y ago
Yes - the Singapore system uses an offline "signing" physical dongle, in which you enter the account that you would like to use, click "sign", and then enter that information into the website, when you wish to add a new payee. The thing is - once you get used to this system, the "cost" faced by the user goes away. I type in a 2FA a dozen times a day when logging in, and the overhead (wait 3 seconds, type in a 6 digit number in 3 seconds) - is really pretty insignificant.
- dublinben 11y ago
  Typing a 2FA code a dozen times a day is a pretty significant cost. You might be used to it, but from someone who does this at most once a day, I find it burdensome.
  - reagency 11y ago
    Why would you type a 2FA code when you have bluetooth?
    - dublinben 11y ago
      Why would you trust Bluetooth for anything security related?
Joeri 11y ago
We use a system like this in Belgium. You slide your card into the device (which is not connected to the internet), then input a challenge and (sometimes) the account number to transfer to and the amount to transfer, followed by your pin. The device then shows a response which you input into the online banking to sign your transaction. The account number and amount only have to be input for large transactions or new account numbers. They used to not require that, but then a set of viruses went around which would show an error page to the user but use the response token to perform a large transaction in the back-end. It's inconvenient, but relatively secure. All in all a worthwhile trade-off I would say. It was shocking to me how casually credit card transactions were done when I went to the US the past few years. I didn't even know the magnetic strip on my card even had a purpose until I had it scanned into a register. I've never known a store in europe use the magnetic strip and signature, they always use the chip and pin method.
IceSt0rm 11y ago
Of course, no method is entirely secure. ChipTAN is pretty slick but is it a convenient/affordable/accessible solution? This is, I think the point of the article. While it may rationally make sense to use a solution like this, many users may flat out reject it.

ghshephard 11y ago

Yes - the Singapore system uses an offline "signing" physical dongle, in which you enter the account that you would like to use, click "sign", and then enter that information into the website, when you wish to add a new payee. The thing is - once you get used to this system, the "cost" faced by the user goes away. I type in a 2FA a dozen times a day when logging in, and the overhead (wait 3 seconds, type in a 6 digit number in 3 seconds) - is really pretty insignificant.

dublinben 11y ago
Typing a 2FA code a dozen times a day is a pretty significant cost. You might be used to it, but from someone who does this at most once a day, I find it burdensome.
- reagency 11y ago
  Why would you type a 2FA code when you have bluetooth?
  - dublinben 11y ago
    Why would you trust Bluetooth for anything security related?

Joeri 11y ago

We use a system like this in Belgium. You slide your card into the device (which is not connected to the internet), then input a challenge and (sometimes) the account number to transfer to and the amount to transfer, followed by your pin. The device then shows a response which you input into the online banking to sign your transaction. The account number and amount only have to be input for large transactions or new account numbers. They used to not require that, but then a set of viruses went around which would show an error page to the user but use the response token to perform a large transaction in the back-end. It's inconvenient, but relatively secure. All in all a worthwhile trade-off I would say. It was shocking to me how casually credit card transactions were done when I went to the US the past few years. I didn't even know the magnetic strip on my card even had a purpose until I had it scanned into a register. I've never known a store in europe use the magnetic strip and signature, they always use the chip and pin method.

IceSt0rm 11y ago

Of course, no method is entirely secure. ChipTAN is pretty slick but is it a convenient/affordable/accessible solution? This is, I think the point of the article. While it may rationally make sense to use a solution like this, many users may flat out reject it.