Hacker News Reader

Comment by rb808 | Hacker News Reader

One thing I'd like is different levels of authentication based on the importance of the action.

When I bought I house I drained by savings account and my brokerage account. It was scary that I could instantly transfer my life savings, with just a few clicks from the regular online screens I use each day. Such events should have extra authentication and some delays - like I need to take ID to a branch.

Similarly for domains - if someone wants to change some dns settings - 2FA is good enough. If someone wants transfer the domain I'd like a much higher level of proof including physical mail sent to my address and a month-long delay with multiple confirmations. I'm surprised the cut-throat world of registrars don't compete on this.

View on HN

I still remember the pit in my stomach when I logged into my brokerage account and saw virtually all of my money gone.

Yes, I had just bought a house. Yes, I had initiated the wire transfer. In fact, I was logging in to check my balance and make sure the transfer had gone out. But it was STILL shocking to see all my money missing.

>> I'm surprised the cut-throat world of registrars don't compete on this.

How many people go looking for that though? For most people my guess is people go shopping for CHEAP first, EASY second, maybe LOOKS GOOD third, and some where down that list is "much more secure". I hate to say, I rarely go looking for the more secure option of anything.

agree, we just made a small survey among our customers to learn whether they are looking for more secure way of authentifiction and data storage generally for their work/business (not only our product) and of course almost everybody replied with "yes, definitely, we need more security" and on the next questions about how much are they willing to spend on it, more than 80% replied with "depends on the price", which means security is indeed not in the top priority and is quite price elastic.

It's why I started doing more of my business with Hover.com. I wanted a reliable looking company with 2FA. That was important to me.

I was at Hover and moved most of my domains to NameCheap. The only way I could change my last name on my Hover account was to remove 2FA to prove that I was the owner of the account. No ability to give them a code verbally, etc. Remove, change my name, re-add. It didn't sit well with me for some reason.

physical mail is not secure by _any_ stretch of the imagination

Registered mail is better though. Even though its "expensive" (~7 EUR here), I think it's worth the price when transferring a domain.

When I did this several years ago, it required several levels of verbal verification interactions up to senior account managers at my brokerage. I'm surprised it was so easy for you to do the same.

this is something that my bank is testing on its users now, whether I need to confirm the transaction or cancel my automatic deposit prolongation it asks me to make a photo and send it to them for confirmation, which takes them in average 5-10 minutes. Though it is not a ver comfortable way for an end-customer, I guess some kind of biometric authentication/confirmation will take place as soon as a user will tolerate that.

>> I guess some kind of biometric authentication/confirmation will take place as soon as a user will tolerate that.

Hopefully our concept of authentication doesn't slip down the slope so far that we start allowing biometrics for it.

Reply on news.ycombinator.com