News for hackers. Stuff that matters.
Re:Ask HN: Gmail account security by nextos on Sunday January 23, 2022 @07:10PM (#30052093)
I agree. I change my phone number often and this is annoying.

It's also very annoying that most EU banks rely on SMS codes to confirm transactions as it's quite easy to clone SIM cards. Yet they don't support real OATH OTP.

I hate Office 365, but I have to concede that their login is much more robust. I use passwords + OATH and it's truly reliable.

Gmail has locked me out very often for no clear reason. Besides they don't support TOTP unless you use a key or a phone app. So I can't use an airgapped device to store my keys.

Re:Ask HN: Gmail account security by jounker on Sunday January 23, 2022 @07:54PM (#30052331)
Not my experience in the germanic portions of Europe. Every bank i’ve been involved with in the last 20 years has had otps of one kind or another.
Re:Ask HN: Gmail account security by nextos on Sunday January 23, 2022 @08:09PM (#30052451)
That's interesting. What 2FA system do they use exactly?

AFAIK, N26 still uses on-time codes sent by SMS which I regard as very insecure.

Re:Ask HN: Gmail account security by jounker on Friday January 28, 2022 @02:57PM (#30119541)
It had completely depended on the bank. In the Netherlands, 20 years ago it was a hardware OTP device. Same with a big Swiss bank ten years ago. Up until a few years ago with a big german bank it was a physical sheet of OTPs. Now it’s a mobile app that either recognizes a challenge image, or receives a challenge by network.
Re:Ask HN: Gmail account security by Semaphor on Sunday January 23, 2022 @09:44PM (#30053113)
N26 has always used their proprietary app confirmation. I never (in over 5 years) got an SMS instead from them. But that’s in Germany, maybe it differs between countries?