Hacker News Reader

Comment by tluyben2 | Hacker News Reader

I keep telling my bank SMS 2fa is bad but they say it is not. Many banks replaced tokens with SMS unfortunately.

If you're using PayPal, they support proprietary one time key and SMS, a guy came up with a method to use any 2FA app with paypal: https://medium.com/@dubistkomisch/set-up-2fa-two-factor-auth...

Just tried it myself, it works.

I don't know any bank that supports token-based 2FA and most support both SMS and email based 2FA. Email is a terrible 2FA method since most users re-use passwords.

One way to help protect you is to visit your carrier's retail store and have them turn off online access to your account and require all changes to your account to be done in person with a valid government ID. This should make it more difficult for number porting attacks but they can still sniff the SMS message when goes over the cell network. As far as I know, mobile network control messages aren't protected.

Several British banks use Chip+PIN cards to provide a token — not necessarily for login, but for authorizing a transaction.

Like this: https://c7.alamy.com/comp/CYGATP/online-banking-security-chi...

>I don't know any bank that supports token-based 2FA

Wells Fargo supports RSA SecurID tokens.

Source : I have one.

However, they also support SMS as an alternative. I'm not sure if SMS can be disabled..

I have several hardware tokens for banks; the one of the Rabobank is as big and heavy as some phones :/ It has a camera and color screen built in. Secure but jikes I don't want to drag it around. The rest all do SMS only; I have never heard of 2fa via email; that sounds like the worst idea ever.

Your average mom & pop can't handle TOTP 2FA, they will inevitably need to reset it when changing phones.

FOB based token generator that you can attach to your keys is pretty braindead. Some banks used to issue them but have switched to SMS/EMail.

Around here it is still mandatory, that or something on the SIM card of the phone that 1) displays a popup that you can match with the bank login screen and then 2) type a separate pin code on your phone to unlock.

Reply on news.ycombinator.com