Hacker News Reader

Comment by dalore | Hacker News Reader

Banks in the UK have been handing out hardware fobs. Not USB devices you put in, but a calculator like interface where you input the challenge they give you and you type the response back.

I guess it works since it doesn't need anything else special and can easily work with web flows.

View on HN

I think you mean a ChipTAN generator.

https://en.wikipedia.org/wiki/Transaction_authentication_num...

Banks in the US also hand out hardware devices, especially for business accounts.

I have RSA token device from Wells Fargo for example.

The problem with these is that I need a special device for every single account. There are two business accounts I have access to and I have to deal with two hardware devices.

The ones in the UK are a standard - every account I have uses the same ones and they are interchangeable. Everyone I know had one - they are ubiquitous as the chip and pin standard is here.

I've not used mine for some time now, as my bank offers the same function via the smartphone. Very handy though.

I have 2 bank accounts in the UK, and neither of them provided an hardware fob.

It's frankly a bit disappointing, since storing secrets in their mobile app means that at the end of the day, when you do banking on your phone, you're really using only 1-factor authentication

That's interesting - I have accounts with three of the major banks and all of them have me them (they do use it different amounts, some only for signing transfers, some for everything including logging in).

The nice thing about these is that you do need something else special but that something else is your bank card, and the PIN used to access it.

Only for some banks, e.g. Barclays. HSBC's version[1] does not require a card to use.

[1]: https://www.hsbc.co.uk/1/2/contact-and-support/security-cent...

Reply on news.ycombinator.com