Hacker News Reader

Comment by philjohn | Hacker News Reader

And this is just another reason why SMS based 2FA is fundamentally broken.

I bank with Barclays in the UK and they give each of their account holders a PinSentry device. This is a physical device that you have to insert your card into, and then enter your pin code to unlock, you then use it to sign/verify transactions that you are trying to make.

Don't have access to the pin sentry device? Guess who can't add a new transfer recipient.

View on HN

The chink in the chain for Barclays though is their mobile app on-boarding that relies on bank account information and SMS authentication which turns your phone into a PinSentry too.

Don't get me wrong, Barclays probably does it better than anyone else but I was surprised when I set up a new phone recently.

That's odd - when I installed the iOS app I either had to get a one-time-code by using a Barclays ATM, or by identifying with my physical PinSentry device ...

Barclays is a terrible example. If someone obtain your pin and nick your card then can do anything with your bank account as the card works with any pinsentry.

Much better is HSBC. The device you get is the only one that works, you cannot use different device.

If someone obtain your pin and nick your card

If that is the case there are many options available to you that do not require pinsentry. This argument makes no sense in the context of this discussion.

Reply on news.ycombinator.com