4 ms·

>Want to do login to your bank account? 100% required that you have an two-factor SMS token in addition to your user ID and password. Thing is, if making the c

>Want to do login to your bank account? 100% required that you have an two-factor SMS token in addition to your user ID and password. Thing is, if making the choice to have two-factor authentication for the bank is rationally wrong (i.e. the cost of security exceeds the damage of compromise), this isn't actually helping? The point of the article is that users reject security advice for good reason. Forcing them to accept your security advice doesn't help; quite the opposite, it is forcing them to pay the cost of security despite it being not viable. (in this particular example it maybe that the two factor auth is low-friction enough that it 'pays off'. If the article is right, simply giving people the option of two factor auth will have them use it)

Domenic_S 11y ago
IME people don't worry too much about 2FA/really secure passwds until they're protecting something they think is valuable. I didn't 2fa my github account for a long long time, despite the ease of use, until I got added to some big projects. Likewise, the average bank member is (speculating here) gonna say, "who wants to steal that $75 in my checking account? not worth it". But an account breach could end up costing a lot more than $75, especially to the bank who has to file insurance claims and do the paperwork, and ofc the time lost to the person who only had $75 to begin with. What I'm trying to say is (I think) that the cost of a bank account breach is hard to measure, because there are a ton of marginal costs associated with it. Locking your credit reports, getting new bank accounts, changing all your autopays, possibly bouncing checks or autopays not going through, filing police reports, filling out claims paperwork, following up on all that, unlocking your credit next time you want to buy a car, etc. Lots and lots of marginal costs in terms of fees and your time.
- TheCoelacanth 11y ago
  The cost that your security policies inflict on users is also hard to measure.
perlgeek 11y ago
> Thing is, if making the choice to have two-factor authentication for the bank is rationally wrong (i.e. the cost of security exceeds the damage of compromise), this isn't actually helping? But it isn't rationally wrong, from the perspective of the bank. The bank isn't paying for the user's time while using 2fa; for the bank the cost is "only" creating and operating the 2fa system. Likewise if you are an ISP or a datacenter operator, security best practices might actually make economic sense, both because of the higher thread and the relatively high stakes.
- obastani 11y ago
  The article is talking about total economic costs (i.e., to all users, the bank, etc.), not just from the perspective of the banks. In other words, we as a society may lose more by implementing "best security practices".
- manarth 11y ago
  'for the bank the cost is "only" creating and operating the 2fa system.' Plus the loss of goodwill, for the customers who aren't happy with the added friction of 2fa.

Domenic_S 11y ago

IME people don't worry too much about 2FA/really secure passwds until they're protecting something they think is valuable. I didn't 2fa my github account for a long long time, despite the ease of use, until I got added to some big projects. Likewise, the average bank member is (speculating here) gonna say, "who wants to steal that $75 in my checking account? not worth it". But an account breach could end up costing a lot more than $75, especially to the bank who has to file insurance claims and do the paperwork, and ofc the time lost to the person who only had $75 to begin with. What I'm trying to say is (I think) that the cost of a bank account breach is hard to measure, because there are a ton of marginal costs associated with it. Locking your credit reports, getting new bank accounts, changing all your autopays, possibly bouncing checks or autopays not going through, filing police reports, filling out claims paperwork, following up on all that, unlocking your credit next time you want to buy a car, etc. Lots and lots of marginal costs in terms of fees and your time.

TheCoelacanth 11y ago
The cost that your security policies inflict on users is also hard to measure.

perlgeek 11y ago

> Thing is, if making the choice to have two-factor authentication for the bank is rationally wrong (i.e. the cost of security exceeds the damage of compromise), this isn't actually helping? But it isn't rationally wrong, from the perspective of the bank. The bank isn't paying for the user's time while using 2fa; for the bank the cost is "only" creating and operating the 2fa system. Likewise if you are an ISP or a datacenter operator, security best practices might actually make economic sense, both because of the higher thread and the relatively high stakes.

obastani 11y ago
The article is talking about total economic costs (i.e., to all users, the bank, etc.), not just from the perspective of the banks. In other words, we as a society may lose more by implementing "best security practices".
manarth 11y ago
'for the bank the cost is "only" creating and operating the 2fa system.' Plus the loss of goodwill, for the customers who aren't happy with the added friction of 2fa.