Passwords Evolved: Authentication Guidance for the Modern Era

Re:Passwords Evolved: Authentication Guidance for the Modern... by thinkfurther on Wednesday July 26, 2017 @08:28AM (#14855594)

> For first car did I write "Ford", "ford", "Focus", "Ford Focus", etc?

No biggie, the person telling you at length about the quirks of their first car until you mention what your first car was will happily try them all.

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by rockostrich on Wednesday July 26, 2017 @08:48AM (#14855714)

One of the questions my bank asks is what middle school I went to and I used my elementary school by mistake. I just listed every school I went to to the guy on the phone when trying to unlock my account. It's a good thing they also ask for SSN/amount previously in the account/who your last check was made out to and that sort of thing.

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by dhimes on Wednesday July 26, 2017 @11:54AM (#14857302)

I'm of the opinion that the answer to those questions should have nothing to do with the question. Make of first car? Equilateral.

EDIT: like this https://news.ycombinator.com/item?id=14856834

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by distances on Wednesday July 26, 2017 @10:14AM (#14856304)

A secret question asked by a bank would be a strong hint for me to take my money elsewhere. They definitely should be using one-time keys from a paper slip or some similar third factor.

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by 0xffff2 on Wednesday July 26, 2017 @12:04PM (#14857428)

Does any bank (or anyone, actually) really do this though? It's easy to say you should take your money elsewhere, but where would you actually take it?

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by noinsight on Wednesday July 26, 2017 @05:52PM (#14860701)

In Finland they all do. Before mobile apps, they mailed you cards with one time passwords in them, every time you logged in you had to provide your account number and OTP. Also, every time you confirmed a payment, you had to use a random security code from said card.

These days they provide apps for phones where when you make a payment you have to open the bank app and enter your PIN to confirm the payment. Same for logging in to online banking (for which there are mobile apps as well).

Also, when making a debit/credit card payment online, you also have to confirm it with one of the aforementioned methods. You can't do anything with just the card details.

I can't believe some banks around the world use plain old passwords only...

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by thinkfurther on Wednesday July 26, 2017 @06:30PM (#14860980)

https://en.wikipedia.org/wiki/Transaction_authentication_num...

If a bank doesn't offer something like that, but still happily does online banking, I'd take my money... anywhere else, even a mattress or the sugar jar.

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by 0xffff2 on Friday July 28, 2017 @12:26PM (#14875430)

Well, never put yourself in a position where you need a bank account in the US then.

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by tscs37 on Wednesday July 26, 2017 @04:41PM (#14860118)

My bank goes a step farther and requires me to physically show up in their branch office and verify my ID. It has to be the branch near my residence.

It's not a bother since it's a 5 minute walk but I imagine that it would be hard for anyone other than me to actually do this, they'd have to show up there and convince the people there they are actually me (and some of these people now me personally)

I'd say that this would be the optimum in security.

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by distances on Wednesday July 26, 2017 @12:47PM (#14857846)

Answered the sibling already, but I have experience only with European banks where I don't see this happening. I have account in two banks, both of which provided a paper slip with one-time authorization codes.

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by dfox on Wednesday July 26, 2017 @01:00PM (#14857984)

One european bank I have account at uses security question, but it seems to be only used as additional layer of authentication when you make changes to your account settings (in person) and not for anything online.

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by tim333 on Wednesday July 26, 2017 @12:41PM (#14857782)

Santander International do for a start.

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by keevie on Wednesday July 26, 2017 @12:32PM (#14857697)

That's a nice idea, but at least every us bank I've seen does this, so...

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by distances on Wednesday July 26, 2017 @12:44PM (#14857814)

That's definitely a bit tougher then. I have experience only with European banks that don't do the security question theater.

[ Parent | on HN ]