Hacker News Reader

Comment by pjc50 | Hacker News Reader

Similarly I remember the first organisation that really tried to get me as a user to care about account security with a hardware token was .. World of Warcraft. Followed a bit later by the use of TOTP in Steam. Banks meanwhile are either stuck in the past or have tried bad proprietary solutions.

Domain registrars are an odd one, because so rarely does one need to log in or do anything - but when you do it may be urgent.

View on HN

> Banks meanwhile are either stuck in the past or have tried bad proprietary solutions.

Or they have a standardized API for accessing all accounts, and use your existing debit card’s security module to sign and authorize all messages you send via this API.

That’s FinTS, and every German bank supports it. Standardized, univerals, open, and secure.

Oh, and KMyMoney and GNUCash also have plugins to directly access it, and there’s even a taskbar widget for KDE to always show your account balance.

Banks in the UK have been handing out hardware fobs. Not USB devices you put in, but a calculator like interface where you input the challenge they give you and you type the response back.

I guess it works since it doesn't need anything else special and can easily work with web flows.

I think you mean a ChipTAN generator.

https://en.wikipedia.org/wiki/Transaction_authentication_num...

Banks in the US also hand out hardware devices, especially for business accounts.

I have RSA token device from Wells Fargo for example.

The problem with these is that I need a special device for every single account. There are two business accounts I have access to and I have to deal with two hardware devices.

The ones in the UK are a standard - every account I have uses the same ones and they are interchangeable. Everyone I know had one - they are ubiquitous as the chip and pin standard is here.

I've not used mine for some time now, as my bank offers the same function via the smartphone. Very handy though.

I have 2 bank accounts in the UK, and neither of them provided an hardware fob.

It's frankly a bit disappointing, since storing secrets in their mobile app means that at the end of the day, when you do banking on your phone, you're really using only 1-factor authentication

That's interesting - I have accounts with three of the major banks and all of them have me them (they do use it different amounts, some only for signing transfers, some for everything including logging in).

The nice thing about these is that you do need something else special but that something else is your bank card, and the PIN used to access it.

Only for some banks, e.g. Barclays. HSBC's version[1] does not require a card to use.

[1]: https://www.hsbc.co.uk/1/2/contact-and-support/security-cent...

for many years my SomethingAwful password was more secure than any other online account I had.

Reply on news.ycombinator.com