Passwords Evolved: Authentication Guidance for the Modern Era

Re:Passwords Evolved: Authentication Guidance for the Modern... by 0xffff2 on Wednesday July 26, 2017 @12:04PM (#14857428)

Does any bank (or anyone, actually) really do this though? It's easy to say you should take your money elsewhere, but where would you actually take it?

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by noinsight on Wednesday July 26, 2017 @05:52PM (#14860701)

In Finland they all do. Before mobile apps, they mailed you cards with one time passwords in them, every time you logged in you had to provide your account number and OTP. Also, every time you confirmed a payment, you had to use a random security code from said card.

These days they provide apps for phones where when you make a payment you have to open the bank app and enter your PIN to confirm the payment. Same for logging in to online banking (for which there are mobile apps as well).

Also, when making a debit/credit card payment online, you also have to confirm it with one of the aforementioned methods. You can't do anything with just the card details.

I can't believe some banks around the world use plain old passwords only...

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by thinkfurther on Wednesday July 26, 2017 @06:30PM (#14860980)

https://en.wikipedia.org/wiki/Transaction_authentication_num...

If a bank doesn't offer something like that, but still happily does online banking, I'd take my money... anywhere else, even a mattress or the sugar jar.

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by 0xffff2 on Friday July 28, 2017 @12:26PM (#14875430)

Well, never put yourself in a position where you need a bank account in the US then.

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by tscs37 on Wednesday July 26, 2017 @04:41PM (#14860118)

My bank goes a step farther and requires me to physically show up in their branch office and verify my ID. It has to be the branch near my residence.

It's not a bother since it's a 5 minute walk but I imagine that it would be hard for anyone other than me to actually do this, they'd have to show up there and convince the people there they are actually me (and some of these people now me personally)

I'd say that this would be the optimum in security.

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by distances on Wednesday July 26, 2017 @12:47PM (#14857846)

Answered the sibling already, but I have experience only with European banks where I don't see this happening. I have account in two banks, both of which provided a paper slip with one-time authorization codes.

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by dfox on Wednesday July 26, 2017 @01:00PM (#14857984)

One european bank I have account at uses security question, but it seems to be only used as additional layer of authentication when you make changes to your account settings (in person) and not for anything online.

[ Parent | on HN ]

Re:Passwords Evolved: Authentication Guidance for the Modern... by tim333 on Wednesday July 26, 2017 @12:41PM (#14857782)

Santander International do for a start.

[ Parent | on HN ]