Hacker News Reader

Comment by guinea-unicorn | Hacker News Reader

I find it funny how MFA is treated as if it would make account takeover suddenly impossible. It's just a bit more work, isn't it? And a big loss in convenience.

I'd much rather see passwords entirely replaced by key-based authentication. That would improve security. Adding 2FA to my password is just patching a fundamentally broken system.

View on HN

Customer service at one of my banks has an official policy of sending me a verification code via email that I then read to them over the phone, and that's not even close to the most "wrong" 2FA implementation I've ever seen. Somehow that institution knows what a YubiKey is, but several major banks don't.

Financial institutions are very slow to adopt new tech. Especially tech that will inevitably cost $$$ in support hours when users start locking themselves out of their accounts. There is little to no advantage to being the first bank to implement YubiKey 2FA. To a risk-averse org, the non-zero chance of a botched rollout or displeased customers outweighs any potential benefit.

They're pretty terrible when they do.

For the longest time the max password size was 8 characters and the csr knew what your password was.

Heck I've had Chase security tell me they'd call me back.. dude that's exactly how people get compromised.

A friensd bank, hopefully not the one i use, only allow a password off 6 digits. Yes You read it right, 6 fucking digits to login, i hace him the asvice to run away from that shitty bank

Did this bank start out as a "telephone bank"? One of the largest German consumer banks still does this because they were the first "direct bank" without locations and typing in digits on the telephone pad was the most secure way of authenticating without telling the "bank teller" your password. So it was actually a good security measure but it is apparently too complicated to update their backend to modern standards.

They do require 2FA, though.

DiBa?

Exactly. 8 character password in the 2010s as the only factor was fine. It was only my money we're talking about.

Now I have to wait for an SMS. Great...

SMS is fine on most countries. It’s just America is dumb and allows number transfers to anyone.

Its also been a problem in Australia, Optus (2nd biggest teleco) used to allow number porting or activating sim against an existing account with a bare minimum of detail - Like a name, address and date of birth. If you had those details of a target you could clone their SIM and crack any SMS based MFA.

Is that alllowed now still?

Apparently changed in 2022 to protect consumers.

Number transfers in other countries is also mostly just a question of a bit of social engineering.

No. Most require some form of identification or matching identification between mobile providers.

I recently had an issue with a sim card and went to phone store that gave me a new one and disabled the old. They're supposed to ask for ID, but often doesn't bother. This is true for pretty much every country. Phone 2FA is simply completely insecure.

If the ID matching is done by humans, you can use social engineering on it.

See the sibling comment.

SMS is not E2E encrypted, so for all intents is just a plain text message that can/has been snooped. Might as well just send a plaintext emails as well.

Nope, I read The Register (UK based) and they've had scandals from celebrities having their confidential SMS messages leaked; SMS spoofing; I think they even have SIM cloning going on every now and then in UK and some European countries. (since The Register is a tech site, my recollection is some carriers took technical measures to prevent these issues while quite a few didn't.)

I don't think it's a thing that happens that often in UK etc.; but, it doesn't happen that frequently in the US either. It's just a thing that can potentially happen.

UK has plenty of other problems to solve first with identity thief.

...where identity is proved by utility bills instead of government issued id

How else do you prove you live some place?

“I pay the bills there” is barely better than nothing, though. We do this in Canada too. It is what I used for a driver’s license one renewal.

I don’t know about other parts, but here in France SMS is a shitshow. I regularly fail to receive them even though I know I have good reception.

This happened the other day while I was on a conference call with perfect audio and video using my phone’s mobile data.

A few weeks back, had some shop which sends out an SMS to inform you the job’s done tell me this is usually hit and miss when I complained about not hearing from them.

Many single radio phones can either receive sms/calls, or transmit data. My relative owns such a device and cannot use internet during calls or receive/make calls during streaming like YT video playback.

In my case this is an iPhone 14 pro. I'm pretty sure I can receive calls while using data, since I often look things up on the internet while talking to my parents.

And, by the way, the SMS in question never arrived. I don't know if there's some kind of timeout happening, and the network gives up after a while. Some 15 years ago I remember getting texts after an hour or two if I only had spotty reception. This may of course have changed in the meantime, plus this is a different provider.

SS7 is a global issue, and so is social engineering to get a number transferred or SIM card transferred.

https://hitcon.org/2015/CMT/download/day1-d-r0.pdf

Uh many banks provide MFA. And secure with hardware keys. It’s just that your level of assets doesn’t warrant that kind of protection.

Source: worked at all the major banks, all the wealthy clients use hardware MFA

They’re a bank. If they can secure their portals with hardware keys, at least allow customers to onboard their own keys.

My bank gave me an hardware token to protect my 5k€ account.

Get better banks people :)

I meant to say in the us. You know how backwards we are here :)

The bank I used in The Netherlands provides a MFA device as well. The device requires an ATM card as well to generate a random number.

This is the default for all their customers, wealthy or not.

https://www.abnamro.nl/en/commercialbanking/internetbanking/...

I meant to say in the us :)

> There is little to no advantage to being the first bank to implement YubiKey 2FA

Ideally they’d just implement passkeys (webauthn/fido). More secure, and it works with iOS, android, 1password, and yubikeys

Just say BofA.

Not actually. Even if you enabled passkey, you still can login to their phone app via SMS. So it is not more secure. People who knows how to do SMS attacks certainly knows how to install a mobile app. And BofA gave their customers a fake assurance.

I'm security consultant in the financial industry. I've literally been involved in the decision making on this at a bank. Banks are very conservative, and behave like insecure teenagers. They won't do anything bold, they all just copy each other.

I pushed YubiKey as a solution and explained in detail why SMS was an awful choice, but they went with SMS anyway.

It mostly came down to cost. SMS was the cheapest option. YubiKey would involve buying and sending the keys to customers, and they having the pain/cost of supporting them. There was also the feeling that YubiKeys were too confusing for customers. The nail in the coffin was "SMS is the standard solution in the industry" plus "If it's good enough for VISA it's good enough for us".

But why won’t banks at least support customer provided yubikeys?

Because it's extra hassle?

> But why won’t banks at least support customer provided yubikeys?

> support

You answered your own question.

And that’s the answer isn’t it? Banks are behind the times in terms of security and tech.

Banks loathe anything relating, or adjacent, to good SWE principles.

Bank of America supports user purchased TOTP devices.

https://www.bankofamerica.com/security-center/online-mobile-...

Brokerage, not bank, but you can do Yubikey-only at Vanguard.

https://www.bogleheads.org/forum/viewtopic.php?t=349826

The largest US crypto brokerages/exchanges support yubikey.

Some will provide and require them for top customers to ensure they are safe.

I'd guess part of the reason is that customers would blame the bank when their YubiKey doesn't work, which would become a nuisance for them as much as the YubiKey's usability issues are a nuisance for the customer.

I mean your employer wasn’t wrong. Yubikeys ARE way too confusing for the average user, way too easy to lose, etc. maybe have it as an option for power users, but they were right it would be a disastrous default.

Interesting. I assumed a lot of client software for small banks was vendored - I know that's the case for brokerages. Makes it all the weirder that they all imitate each other.

Here's the thing about SMS: your great aunt who doesn't know what a JPEG is, knows what a text is. Ok, she might not fully "get it" but she knows where to find a text message in her phone. My tech-literate fiancée struggles to get her YubiKey to work with her phone, and I've tried it with no more luck than she's had. YubiKeys should be supported but they're miles away from being usable enough to totally supplant other 2FA flows.

Banks are in a tough spot. Remember, banks have you as a customer, they also have a 100 year old person who still wants to come to the branch in person as a customer. Not everyone can grapple with the idea of a Yubikey, or why their bank shouldn't be protecting their money like it did in the past.

The problem is that the bank will automatically enable online access and SMS-confirmed transfers for that 100 year old person who doesn't even know how to use Internet.

yeah someone replied to one of my comments about adding MFA that an attacker can get around all that simply by buying the account from the author. I was way too narrowly focused on the technical aspects and was completely blind to other avenues like social engineering, etc.

All very fair points.

>I'd much rather see passwords entirely replaced by key-based authentication

I've never understood how key-based systems are considered better. I understand the encryption angle, nobody is compromising that. But now I have a key I need to personally shepherd? where do I keep it, and my backups, and what is the protection on those places? how many local copies, how many offsite? And I still need a password to access/use it, but with no recourse should I lose or forget. how am I supposed to remember that? It's all just kicking the same cans down the same roads.

Passkeys are being introduced right now in browsers and popular sites like a MFA option, but I think the intention is that they will grow and become the main factor in the future.

From what I've seen they're all controlled by huge tech companies. Hard pass.

I liked the username, password and TOTP combination. I could choose my own password manager, and TOTP generator app, based on my preferences.

I have a feeling this won't hold true forever. Microsoft has their own authenticator now, Steam has another one, Google has their "was this you?" built into the OS.

Monetization comes next? "View this ad before you login! Pay 50c to stay logged in for longer?"

Passkeys are an open standard with multiple implementations. It represents the opposite of the trend you're worried about there.

But the way it is designed, you can require a certain provider, and you can bet at least some sites will start requiring attestation from Google and or Apple.

Do they do attestation by default? I thought for Apple at least that was only a feature for enterprise managed devices (MDM). Attestation is also a registration-time check, so doesn’t necessarily constrain where the passkey is synced to later on.

MS Azure Active Entra's FIDO2 implementation only allows a select list of vendors. You need a certification from FIDO ($,$$$), you need to have an account that can upload on the MDS metadata service, and you need to talk to MS to see if they'll consider adding you to the list

It's not completely closed, but in practice no one on that list is a small independent open source project, those are all the kind of entrenched corporate security companies you'd expect

Because that worked so well for OpenID. If you're lucky, you have the choice of which BigTech account you can use.

TOTP has substantial security gaps to make it a non-starter.

Maybe a pubkey system where you choose your own client would be what you’re looking for?

TLS Client Certs (aka mTLS) is an option for that, but the browser UI stuff for it is terrible and getting worse.

I couldn’t imagine trying to train the general public to use mTLS and deploy that system.

I’m not even sure it is difficult. Most people I’ve talked to in tech don’t even realize it is a possibility. Certificates are “complicated” as they put it.

> Google has their "was this you?" built into the OS.

Not only that, but it's completely impossible to disable or remove that functionality or even make TOTP the primary option. Every single time I try to sign in, Google prompts my phone first, giving me a useless notification for later, and I have to manually click a couple of buttons to say "no I am not getting up to grab my phone and unlock it for this bullshit, let me enter my TOTP code". Every single time.

Password managers are adding support (as in they control the keys) and I've used my yubikeys as "passkeys" (with the difference that I can't autofill the username).

It's a good spec. I wish more people who spread FUD about it being a "tech-giant" only thing would instead focus on the productive things like demanding proper import/export between providers.

You realise that the second your password manager has it, then it's no longer MFA but it's just 1 factor authentication with extra steps right?

Password manager turns something you know into something you own. If also the something you own is in the password manager itself… it's the same as requiring extra long passwords.

I don't understand this criticism. What is being controlled? Passkeys are an open standard that a browser can implement with public key crypto.

Doesn't passkeys give the service a signature to prove what type of hardware device you're using? e.g. it provides a way for the server to check whether you are using a software implementation? It's not really open if it essentially has type of DRM built in.

You're thinking of hardware-backed attestation, which provides a hardware root of trust. I believe passkeys are just challenge-response (using public key cryptography). You could probably add some sort of root of trust (for example, have the public key signed by the HSM that generated it) but that would be entirely additional to the passkey itself.

Passkeys do have the option of attestation, but the way Apple at least do them means Apple users won't have attestation, so most services won't require attestation.

They also require JavaScript to work unfortunately.

KeepassXC is working on supporting them natively in software, so you would not need to trust big tech companies, unless you are logging into a service that requires attestation to be enabled.

https://xkcd.com/538/

Reply on news.ycombinator.com