Phone numbers are not proper verification

Re:Phone numbers are not proper verification by Freak_NL on Monday January 16, 2017 @04:13AM (#13408948)

In 2008 I moved to Japan from The Netherlands for a year as a graduate student. I didn't want to bother with my Dutch phone number there, so I looked for alternatives. My bank uses one time codes that are normally sent to you via SMS when you perform a transaction. These can also be pregenerated and sent to you via mail. The online banking environment simply asks me to enter code number x.

I never changed back, so now I receive a new sheet of numbered codes whenever I've used a certain number of them. Nowadays I scan this sheet of codes, run an OCR task, and import the codes in my password manager¹. So when the bank asks for code 519:

    pass -c bank/ing/tan/519

And I have the code on my clipboard.

I wonder how long ING (my bank) will allow this method to exist… The alternative used by Dutch banks is a small token generating device they provide to all customers (I think only ING mentioned above doesn't do this yet). This requires no phone number either, just the (tiny) physical device.

I wonder what happens if I tell my bank that I no longer have a phone number I can be reached at?

1: https://www.passwordstore.org/

[ Parent | on HN ]

Re:Phone numbers are not proper verification by herbst on Monday January 16, 2017 @04:18AM (#13408970)

Same. I also use paper tan right now and one bank account which i have to call if i want something (which i dont care much about, because its not ment to be accessed anyway) but yeah its just a question of time the bank does not send out TANs anymore.

My bank (or both of them) had no solution when i told them that i dont plan on having a phone number anymore. The one accepted it that they cant call me and send paper TANs, the other did not do paper tans for a few years now.

Btw: Your solution to store them sounds nice. Probably gonna adapt that

[ Parent | on HN ]

Re:Phone numbers are not proper verification by nom on Monday January 16, 2017 @04:54AM (#13409106)

Here in Germany we get a Digipass 2FA device from our bank (something like this [0]). For every transaction, you put your banking card in, hold it up to the flashing pattern on the screen, and it creates a TAN for you. Very convenient and secure.

I thought this is more common in Europe, but apparently it's not? Although, our banks are increasingly pushing towards App-based 2FA because it's cheaper.. but I'm very confident they'll continue to support as it is the common way to do online banking.

0: https://www.vasco.com/products/two-factor-authenticators/har...

[ Parent | on HN ]

Re:Phone numbers are not proper verification by wjdp on Monday January 16, 2017 @07:47AM (#13409652)

UK here, quite a few banks have used calculator style[0] devices for 2FA. You insert your chip card, enter the PIN and receive a code. The devices themselves, while branded, seem identical across banks and accounts (I can use one I got from bank A for bank B and vice versa).

Banks now have introduced app based versions of the above, useful if you've not got the calculator or your card handy, but I don't believe they're looking to phase out the physical device just yet.

Seems similar to your device, but instead of an optical sensor to receive a code from the web browser you enter the account code and money amount of a transfer manually.

[0]: https://upload.wikimedia.org/wikipedia/commons/thumb/0/05/Ba...

[ Parent | on HN ]

Re:Phone numbers are not proper verification by herbst on Monday January 16, 2017 @05:12AM (#13409158)

One of my banks does this, paper TAN is more confident for me as i dont have to carry a additional device and worry about driver support. But i surely will change to that as soon paper tan is over.

The other bank only offers different phone based solutions. Clearly my fault for not checking first, and also not a issue for me as i dont actually access that account.

If i could use that with other websites, Twitter, Github, whatever, i would happily carry that device with me :)

[ Parent | on HN ]

Re:Phone numbers are not proper verification by Freak_NL on Monday January 16, 2017 @07:28AM (#13409597)

> I thought this is more common in Europe, but apparently it's not?

It is. Most of the other Dutch banks do use such a device (I haven't seen devices that try to read your screen yet though).

[ Parent | on HN ]

Re:Phone numbers are not proper verification by Sparq on Monday January 16, 2017 @05:12AM (#13409160)

The ING smartphone app can now also be used to approve payments (https://www.ing.nl/particulier/mobiel-en-internetbankieren/i...), but that doesn't exactly remove the phone dependency.

[ Parent | on HN ]