NIST declares the age of SMS-based 2-factor authentication over

Re:NIST declares the age of SMS-based 2-factor authenticatio... by robryk on Tuesday July 26, 2016 @04:37AM (#12164169)

OTOH it's much better if you're authorizing single operations.

My bank in Poland has a scheme where it sends me a one time password together with some details on every mutating operation I do (e.g. on a transfer it sends the amount and account number of the target account).

[ Parent | on HN ]

Re:NIST declares the age of SMS-based 2-factor authenticatio... by forgotpwtomain on Tuesday July 26, 2016 @04:49AM (#12164219)

Then you travel to a country where your mobile provider isn't working and all of a sudden you can't buy an airline ticket. SMS verification is also a terrible user experience.

[ Parent | on HN ]

Re:NIST declares the age of SMS-based 2-factor authenticatio... by Nullabillity on Tuesday July 26, 2016 @04:45AM (#12164203)

All banks in Sweden have a similar scheme. It sends a token and a description to your phone on any mutating or authenticating operation, you input your code, and it signs the token and sends it back to the bank.

[ Parent | on HN ]

Re:NIST declares the age of SMS-based 2-factor authenticatio... by Natanael_L on Tuesday July 26, 2016 @07:35AM (#12164850)

The BankID app? Most banks also have hardware TOTP tokens.

[ Parent | on HN ]

Re:NIST declares the age of SMS-based 2-factor authenticatio... by Nullabillity on Tuesday July 26, 2016 @08:34AM (#12165134)

True, most banks have both. But the hardware tokens seem to be dying, slowly.

Personally I consider the transaction description a pretty killer feature of Mobilt BankID compared to the hardware tokens.

[ Parent | on HN ]