News for hackers. Stuff that matters.

A comment on Black Hat: GDPR privacy law exploited to reveal personal data. Parent comment

Re:Black Hat: GDPR privacy law exploited to reveal personal ... by tom_mellior on Friday August 09, 2019 @01:23PM (#20656430)
Ugh, my Austrian bank is currently trying to force me into using a system like this. The "standard" way is via an Android or iOS app, the "alternative" is via a smartcard reader thing that seems to work with Windows only.

They claim that this is mandatory due to some EU regulation, but they conveniently forget to say what regulation that is supposed to be.

[ Parent | on HN ]
Re:Black Hat: GDPR privacy law exploited to reveal personal ... by Avamander on Friday August 09, 2019 @02:40PM (#20657170)
It's the Payment Services Directive (PSD2). Username+PW is obsolete and insecure at least 20 years now.
[ Parent | on HN ]
Re:Black Hat: GDPR privacy law exploited to reveal personal ... by gioele on Friday August 09, 2019 @08:01PM (#20659233)
> It's the Payment Services Directive (PSD2). Username+PW is obsolete and insecure at least 20 years now.

That does not imply that banks must implement 2FA with their proprietary applications.

Banks could just implement TOTP (Time-based One-time Passwords, RFC 6238) or HOTP (HMAC-based One-time Passwords, RFC 4226) and let me choose how I generate my OTP. For example with an hardware OTP generator or an open source application.

Most banks are using PSD2 as a occasion to force their privacy-invading apps on their users.

[ Parent | on HN ]
Re:Black Hat: GDPR privacy law exploited to reveal personal ... by Avamander on Saturday August 10, 2019 @02:17AM (#20660510)
Absolutely not, I heavily dislike SmartID and similar proprietary spyware as well. A TOTP HW token would be in my opinion more secure. The reason banks use it though is the convenience, having some identity tied to the apps is just a bonus for them.
[ Parent | on HN ]