Hacker News Reader

Comment by ghshephard | Hacker News Reader

I like the approach they take in Singapore - take the default posture that users will probably not be security aware and will also reject your advice.

Want to do login to your bank account? 100% required that you have an two-factor SMS token in addition to your user ID and password.

Want to do bill pay to a new-payer? Not only do you need to have your two-factor SMS token to first login, and then make the payment, you also need the physical token they sent you to do a crypto-sign of the bill payer account information before you can add the new bill-payer.

Coming from the United States, I'm blown away how much more secure (and convenient - Love bank-bank transfers, haven't used a paper cheque in 2+ years) banking is in Singapore. Probably suggests why paypal probably took off faster in the USA then here as well.

View on HN

>Want to do login to your bank account? 100% required that you have an two-factor SMS token in addition to your user ID and password.

Thing is, if making the choice to have two-factor authentication for the bank is rationally wrong (i.e. the cost of security exceeds the damage of compromise), this isn't actually helping?

The point of the article is that users reject security advice for good reason. Forcing them to accept your security advice doesn't help; quite the opposite, it is forcing them to pay the cost of security despite it being not viable.

(in this particular example it maybe that the two factor auth is low-friction enough that it 'pays off'. If the article is right, simply giving people the option of two factor auth will have them use it)

IME people don't worry too much about 2FA/really secure passwds until they're protecting something they think is valuable. I didn't 2fa my github account for a long long time, despite the ease of use, until I got added to some big projects.

Likewise, the average bank member is (speculating here) gonna say, "who wants to steal that $75 in my checking account? not worth it". But an account breach could end up costing a lot more than $75, especially to the bank who has to file insurance claims and do the paperwork, and ofc the time lost to the person who only had $75 to begin with.

What I'm trying to say is (I think) that the cost of a bank account breach is hard to measure, because there are a ton of marginal costs associated with it. Locking your credit reports, getting new bank accounts, changing all your autopays, possibly bouncing checks or autopays not going through, filing police reports, filling out claims paperwork, following up on all that, unlocking your credit next time you want to buy a car, etc. Lots and lots of marginal costs in terms of fees and your time.

The cost that your security policies inflict on users is also hard to measure.

> Thing is, if making the choice to have two-factor authentication for the bank is rationally wrong (i.e. the cost of security exceeds the damage of compromise), this isn't actually helping?

But it isn't rationally wrong, from the perspective of the bank. The bank isn't paying for the user's time while using 2fa; for the bank the cost is "only" creating and operating the 2fa system.

Likewise if you are an ISP or a datacenter operator, security best practices might actually make economic sense, both because of the higher thread and the relatively high stakes.

The article is talking about total economic costs (i.e., to all users, the bank, etc.), not just from the perspective of the banks. In other words, we as a society may lose more by implementing "best security practices".

'for the bank the cost is "only" creating and operating the 2fa system.'

Plus the loss of goodwill, for the customers who aren't happy with the added friction of 2fa.

I get what you're saying, but living in a sketchy cell reception area makes me cringe at the thought of requiring SMS (let alone security concerns surrounding SMS as others have already mentioned). A mobile app instead solves it as near as I can tell... assuming you're okay with requiring a mobile device.

Singapore has had 99.99% coverage since 2000 or so... Quite true that lots of things that make sense for them wouldn't work elsewhere.

Okay, now I'm wondering about something.

A point that Bruce has harped on for years is that the law often creates the wrong incentives for security policies. In particular, in the U.S., the downside of what we call "identity theft" often falls squarely on the consumer, while the security policies for the banking industry are designed by banks. Thus the policy makers may not have to live with the downsides of their own policies.

I'm guessing that the incentives created by the law for banking security are rather different in Singapore -- maybe not ideal, but certainly different.

Can you (or anyone else) comment knowledgeably on this?

Government regulation. The MAS (Monetary Authority of Singapore) basically decreed that all financial institutions follow a standard set of (really, really good) guidelines for Internet Banking. Two-Factor authentication and Transaction-Signing by External Token are just a couple of the 182 requirements.

http://www.mas.gov.sg/~/media/MAS/Regulations%20and%20Financ...

For example, check out: Appendix A - "COUNTERING MAN-IN-THE-MIDDLE ATTACKS "

It has specific guidance such as "Digital signatures and key-based message authentication codes (KMAC) for payment or fund transfer transactions could be used for the detection of unauthorised modification or injection of transaction data in a middleman attack. For this security solution to work effectively, a customer using a hardware token would need to be able to distinguish the process of generating a one-time password from the process of digitally signing a transaction. What he signs digitally must also be meaningful to him. This means the token should at least explicitly show the payee account number and the payment amount from which a hash value may be derived for the purpose of creating a digital signature. Different crypto keys should be used for generating OTPs and for signing transactions. "

The United States (at least the Banks I dealt with) are way behind where Singapore is in terms of Security.

Those are good points but I'm not a fan of two factor SMS. It made sense in the day where a cellphone could make calls and do texting and nothing more, but smartphones are used like computers now. Say you have the typical situation with no pin on the phone and password auto-filled by the mobile browser for the site. Now if someone loses that phone, another person can login, looking at history or auto-fill settings for clues. Alternatively, if there is a password for the site, it's either really simple or the password reset request will come in to the mail client on the phone. Since phones are way more than they used to be, for two factor these days it should be a separate dongle that only does the one factor and it is forced to have a pin by the vendor before it can be used. So SMS two-factor is not really all that much better security-wise and it makes it more inconvenient, doubly so for those like me that don't even have a cellphone.

If you are using your phone for the "something you have" factor in 2FA, you should probably have the device secured with a password, pin, etc. That said, you make a good point, if someone has your phone, it's not locked down, and google (or whoever) remembers your password on your phone, then you are screwed.

People use phones for the second factor because they are convenient and always with them. I think the solution to the problem you stated above is to use "something you are" (thumprint biometrics) as the second factor of authentication instead of "something you have" (SMS code/mobile authenticator).

In the next couple years, most high-end smartphones will probably have thumbprint scanning technology, this seems like a better solution (and more convenient) as you only have to scan your thumb and it'll work as long as you have data, you don't need to worry if you have good cell reception (for SMS).

In most cases you can remotely wipe the compromised device but it will take some small amount of time to do so. You can also de-authorize the device in your password manager, etc.

> Want to do login to your bank account? 100% required that you have an two-factor SMS token in addition to your user ID and password.

Still leaves the user open to MITM, viruses, and SMS interception. You should take a look at chipTAN [1] [2]. The user has to confirm account number and transfer amount on a little device before the crypto chip on the debit card generates a TAN that is valid only for this specific transaction.

I'm not a great fan of German IT (often unimaginative and slow-moving; e.g. none of the major German e-mail providers offer any form of 2FA), but this chipTAN thing is pretty fascinating from a crypto standpoint.

[1] https://en.wikipedia.org/wiki/Transaction_authentication_num...

[2] https://www.youtube.com/watch?v=LAjLXxrqqK8&t=1m9s

Yes - the Singapore system uses an offline "signing" physical dongle, in which you enter the account that you would like to use, click "sign", and then enter that information into the website, when you wish to add a new payee.

The thing is - once you get used to this system, the "cost" faced by the user goes away. I type in a 2FA a dozen times a day when logging in, and the overhead (wait 3 seconds, type in a 6 digit number in 3 seconds) - is really pretty insignificant.

Typing a 2FA code a dozen times a day is a pretty significant cost. You might be used to it, but from someone who does this at most once a day, I find it burdensome.

Why would you type a 2FA code when you have bluetooth?

Why would you trust Bluetooth for anything security related?

We use a system like this in Belgium. You slide your card into the device (which is not connected to the internet), then input a challenge and (sometimes) the account number to transfer to and the amount to transfer, followed by your pin. The device then shows a response which you input into the online banking to sign your transaction. The account number and amount only have to be input for large transactions or new account numbers. They used to not require that, but then a set of viruses went around which would show an error page to the user but use the response token to perform a large transaction in the back-end.

It's inconvenient, but relatively secure. All in all a worthwhile trade-off I would say. It was shocking to me how casually credit card transactions were done when I went to the US the past few years. I didn't even know the magnetic strip on my card even had a purpose until I had it scanned into a register. I've never known a store in europe use the magnetic strip and signature, they always use the chip and pin method.

Of course, no method is entirely secure. ChipTAN is pretty slick but is it a convenient/affordable/accessible solution?

This is, I think the point of the article. While it may rationally make sense to use a solution like this, many users may flat out reject it.

Although not 100% required, a lot of this applies to Europe and to the UK in particular.

What's a paper cheque?

It's important to note that all this is bank security. Someone else gaining access to your online bank account is a catastrophe, losing control of your Steam account is not. Not to mention your 9gag/genericSite accounts. I mean, nobody wants them anyway. Passwords could be optional for all I care.

The only accounts actually worth protecting are bank/government accounts, email and maybe Facebook.

In the US, banks are required to make you whole for personal accounts if you didn't authorize the transaction. Thus it's in the banks' interest to clamp down on the fraud.

Small-businesses need to watch out. They often have significant cash in accounts, are targeted because of that, and don't have the same legal protection.

  What's a paper cheque?

In some countries, banks give account holders books of banknote-sized paper 'cheques' or 'checks' - you can see pictures at https://en.wikipedia.org/wiki/Cheque - they can use for making payments.

They have some convenient properties, but poor fraud protection. As such nowerdays they're mostly relegated to applications where fraud isn't a big worry.

For example charity donations, payments to friends and family, paying for little johnny's karate lessons, stuff like that. Some utility companies also allow you to pay by mailing in a cheque.

To add to that, cheques have unique properties that would be hard to replicate.

You can preemptively write cheques for future payments, like buying a car in two payments: one now and one in 3 months.

It also works for guarantee deposits, or write blank cheques with only the receiver filled in, etc.

Not legally - post-dated checks are illegal.

Even so, two parties who trust each other can use them without calling the police about it. (Actually a post-dated check is not so much illegal as it is invalid and therefore not intrinsically worth anything.)

I worked for a major company which operated in all 50 US states about ten years ago which paid me via post-dated checks. I had to wait a few days after receiving my check in the mail before I could deposit it.

They're legit in some countries: https://en.wikipedia.org/wiki/Post-dated_cheque

Nope. For most U.S. Banks, post dated checks are immediately negotiable.

Few charities or small martial-arts businesses will trust a paper check. The possibility for fraud and nonpayment is too threatening to a small business to be worth it - they'd rather miss the sale than take payment in check.

I haven't seen a non-utility, non-bank business accept paper checks in about 13 years.

I volunteered as a treasurer of a (very) small non-profit org in the USA and in the last couple years I'd conservatively say I deposited many hundreds of checks, with two bounces. Perhaps 3/4 the total cash flow. Figure maybe $10K/yr worth of rather small checks. Generally people trust a check made out to "xyz" will end up in the "xyz" bank account better than just handing money to someone and hoping for the best. Also being a small org ALL our payments were done by me hand writing checks for expense reimbursements, various fees, rentals, etc. To minimize the appearance of impropriety, no cash payments were permitted, all documented and traceable check payments with the check number linked to transaction paperwork (reimbursement form, etc).

Most businesses get to pay for the privilege of having a business account and per transaction, as a volunteer org our banking expenses were zero, and all the competitors (square, paypal, various wallets, etc) all want a cut of the action, even if its small, so we had no interest.

A startup in the wallet business could get a lot of buzz and transactions by offering free service to all volunteer orgs / non profits. Even just temporarily for a year...

Capital One credit cards don't charge feed on charitable donations made through their website.

Why are martial arts special?

And why would a charity care about a bounced check?

I assume that was a response to the ancestor comment about "charity donations, payments to friends and family, paying for little johnny's karate lessons, stuff like that."

FWIW, personal checks for religious offerings seem to be common and accepted (at least accepted enough that I've seen them in offering plates in multiple churches, and I've never seen any church tell people that they'll reject personal checks), so I think you're right on that front.

Anecdotally, I pay for my music lessons with personal checks, and I paid rent in my SF apartment, to an individual landlord, with personal checks sent via USPS. In both cases there are reasonable means to complain if those checks bounce.

Biggest unique-ish uses for cheques -

- They can be mailed, unlike credit cards and cash

- They have no fees for either the sender or receiver

Of course you sacrifice convenience and security in exchange for no fees, which is why they are most commonly used for large transactions between trustworthy parties. For example, tax payments to the IRS.

> They have no fees for either the sender or receiver

Only in countries where checks are common.

Reply on news.ycombinator.com