Hacker News Reader

Comment by alldayeveryday | Hacker News Reader

Your argumentation is myopic. I'm not seeing anyone making excuses. I'm seeing people face the realities that few systems (if any) are without single points of failure.

Take the mobile app dependency away from banking. Then what? There's a dependency on having a computer. A dependency on having power and internet. Why did the banking system build around these single points of failure?

The reality of system design dictates that you measure risk in terms of what is acceptable vs not-acceptable, the solution on whether it is practical vs not-practical, and the implementation on whether it is economically viable. Raising a stink because your bank wants you to use a mobile phone for verification is like complaining that your car requires gasoline to work. Are there other ways of solve the problem? Sure. Did the solution they landed on meet their requirements, yes. I hardly consider them morons for going with the cell phone approach.

View on HN

> Take the mobile app dependency away from banking. Then what? There's a dependency on having a computer.

A computer, but not necessarily the one authorised computer. You can use a public one in a library, a friend's, your employer's, etc. Not the same as your own and only authorised smartphone.

> A dependency on having power and internet.

This is honestly not even an argument, and they're not a SPOF. Both the power grid and the Internet have redundancies built-in.

> is like complaining that your car requires gasoline to work.

Again, it's not. The smartphone is used as a single authorised device. Gasoline works regardless of which station you purchase it from. Out of petrol? Fill it up at the nearby station and carry on. Or preferably, don't let it run out in the first place.

> I hardly consider them morons for going with the cell phone approach.

I don't consider them morons either. That's not to say I don't recognise this as a weakness.

> Again, it's not. The smartphone is used as a single authorised device. Gasoline works regardless of which station you purchase it from. Out of petrol? Fill it up at the nearby station and carry on. Or preferably, don't let it run out in the first place.

A mobile phone works regardless of which store you purchase it from. Lost your phone? Pickup a new one at a nearby store and carry on. Or preferably, don't lose it in the first place.

Again, a mobile phone works regardless of where you purchase it. Your banking systems, etc are not authorised to a mobile phone, though. They're authorised to the one mobile phone that was authenticated.

It's not enough to buy a new phone. You need to contact every single service that's bound to the lost/stolen/broken phone and authorise the new one before you can use their services.

In the case of the car, it's enough to just fill up the tank with petrol purchased anywhere. It's ready to carry on at that point.

Not clear your meaning. Are you referring to the mobile phone being used during 2FA auth flows? In this case, the authorization is not to a device but rather to a number on the cellular network. You can swap devices without your bank knowing and without disrupting your authorization. Are you referring to mobile banking apps? If so, again, the bank is not authorizing an individual device. The authorization is a sign in session on the app. You can swap phones and download the app very easily without contacting the bank.

> It's not enough to buy a new phone. You need to contact every single service that's bound to the lost/stolen/broken phone and authorize the new one before you can use their services.

Are you referring to changing phone numbers maybe? If so, that is a totally different topic from OP and also from my comments.

Reply on news.ycombinator.com