News for hackers. Stuff that matters.

A comment on Phone numbers are not proper verification. Parent comment

Re:Phone numbers are not proper verification by nom on Monday January 16, 2017 @04:54AM (#13409106)
Here in Germany we get a Digipass 2FA device from our bank (something like this [0]). For every transaction, you put your banking card in, hold it up to the flashing pattern on the screen, and it creates a TAN for you. Very convenient and secure.

I thought this is more common in Europe, but apparently it's not? Although, our banks are increasingly pushing towards App-based 2FA because it's cheaper.. but I'm very confident they'll continue to support as it is the common way to do online banking.

0: https://www.vasco.com/products/two-factor-authenticators/har...

[ Parent | on HN ]
Re:Phone numbers are not proper verification by wjdp on Monday January 16, 2017 @07:47AM (#13409652)
UK here, quite a few banks have used calculator style[0] devices for 2FA. You insert your chip card, enter the PIN and receive a code. The devices themselves, while branded, seem identical across banks and accounts (I can use one I got from bank A for bank B and vice versa).

Banks now have introduced app based versions of the above, useful if you've not got the calculator or your card handy, but I don't believe they're looking to phase out the physical device just yet.

Seems similar to your device, but instead of an optical sensor to receive a code from the web browser you enter the account code and money amount of a transfer manually.

[0]: https://upload.wikimedia.org/wikipedia/commons/thumb/0/05/Ba...

[ Parent | on HN ]
Re:Phone numbers are not proper verification by herbst on Monday January 16, 2017 @05:12AM (#13409158)
One of my banks does this, paper TAN is more confident for me as i dont have to carry a additional device and worry about driver support. But i surely will change to that as soon paper tan is over.

The other bank only offers different phone based solutions. Clearly my fault for not checking first, and also not a issue for me as i dont actually access that account.

If i could use that with other websites, Twitter, Github, whatever, i would happily carry that device with me :)

[ Parent | on HN ]
Re:Phone numbers are not proper verification by Freak_NL on Monday January 16, 2017 @07:28AM (#13409597)
> I thought this is more common in Europe, but apparently it's not?

It is. Most of the other Dutch banks do use such a device (I haven't seen devices that try to read your screen yet though).

[ Parent | on HN ]