News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by eairy on Saturday March 30, 2024 @12:13AM (#39871778)
I'm security consultant in the financial industry. I've literally been involved in the decision making on this at a bank. Banks are very conservative, and behave like insecure teenagers. They won't do anything bold, they all just copy each other.

I pushed YubiKey as a solution and explained in detail why SMS was an awful choice, but they went with SMS anyway.

It mostly came down to cost. SMS was the cheapest option. YubiKey would involve buying and sending the keys to customers, and they having the pain/cost of supporting them. There was also the feeling that YubiKeys were too confusing for customers. The nail in the coffin was "SMS is the standard solution in the industry" plus "If it's good enough for VISA it's good enough for us".

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by heyoni on Saturday March 30, 2024 @12:28AM (#39871840)
But why won’t banks at least support customer provided yubikeys?
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by intelVISA on Saturday March 30, 2024 @02:04AM (#39872252)
Banks loathe anything relating, or adjacent, to good SWE principles.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by mulmen on Saturday March 30, 2024 @01:52AM (#39872197)
> But why won’t banks at least support customer provided yubikeys?

> support

You answered your own question.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by heyoni on Saturday March 30, 2024 @11:58AM (#39876065)
And that’s the answer isn’t it? Banks are behind the times in terms of security and tech.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by eru on Saturday March 30, 2024 @01:21AM (#39872066)
Because it's extra hassle?
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by jalk on Saturday March 30, 2024 @05:49AM (#39873333)
Bank of America supports user purchased TOTP devices.

https://www.bankofamerica.com/security-center/online-mobile-...

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by rainbowzootsuit on Saturday March 30, 2024 @08:46AM (#39874338)
Brokerage, not bank, but you can do Yubikey-only at Vanguard.

https://www.bogleheads.org/forum/viewtopic.php?t=349826

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by mlrtime on Saturday March 30, 2024 @09:04AM (#39874487)
The largest US crypto brokerages/exchanges support yubikey.

Some will provide and require them for top customers to ensure they are safe.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by ryukoposting on Sunday March 31, 2024 @08:58PM (#39889802)
I'd guess part of the reason is that customers would blame the bank when their YubiKey doesn't work, which would become a nuisance for them as much as the YubiKey's usability issues are a nuisance for the customer.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by dalyons on Saturday March 30, 2024 @01:25PM (#39876747)
I mean your employer wasn’t wrong. Yubikeys ARE way too confusing for the average user, way too easy to lose, etc. maybe have it as an option for power users, but they were right it would be a disastrous default.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by ryukoposting on Saturday March 30, 2024 @01:27PM (#39876763)
Interesting. I assumed a lot of client software for small banks was vendored - I know that's the case for brokerages. Makes it all the weirder that they all imitate each other.

Here's the thing about SMS: your great aunt who doesn't know what a JPEG is, knows what a text is. Ok, she might not fully "get it" but she knows where to find a text message in her phone. My tech-literate fiancée struggles to get her YubiKey to work with her phone, and I've tried it with no more luck than she's had. YubiKeys should be supported but they're miles away from being usable enough to totally supplant other 2FA flows.

[ Parent | on HN ]