News for hackers. Stuff that matters.
Re:Why are banks still getting authentication so wrong? by eptcyka on Tuesday May 13, 2025 @03:23PM (#43976623)
It's stupid to give out credentials over the phone, but it's stupider still to have a system where one's birth date is a credential that is supposed to remain confidential.
Re:Why are banks still getting authentication so wrong? by airstrike on Tuesday May 13, 2025 @03:35PM (#43976762)
Same for SSNs
Re:Why are banks still getting authentication so wrong? by viewtransform on Tuesday May 13, 2025 @05:22PM (#43977870)
What we need instead is an orb like thing that scans your eyeballs.
Re:Why are banks still getting authentication so wrong? by dzhiurgis on Tuesday May 13, 2025 @05:50PM (#43978165)
If only there was tamper-proof, cryptographically secure chip in everyone's pockets, coupled with a handheld device that can wirelessly "read" that chip.
Re:Why are banks still getting authentication so wrong? by dylan604 on Tuesday May 13, 2025 @06:14PM (#43978348)
If it's in your pocket, then you might leave it in your other pants. Better to just have that chip embedded in your palm. You can even fashion it with LEDs that change color with your age. When you reach 30, you can then be told your Last Day has arrived and they are ready for Carrousel. I'm sure we can fold in plenty of other sci-fi tropes all at the same time too
Re:Why are banks still getting authentication so wrong? by Henchman21 on Tuesday May 13, 2025 @07:57PM (#43979236)
Listen if Jenny Agutter is involved, count me in!
Re:Why are banks still getting authentication so wrong? by anon7000 on Tuesday May 13, 2025 @03:39PM (#43976816)
I mean this is basically the ENTIRE US health system
Re:Why are banks still getting authentication so wrong? by LtWorf on Tuesday May 13, 2025 @04:20PM (#43977245)
Healthcare in USA is famous for many things, but making sense is not one of them.
Re:Why are banks still getting authentication so wrong? by kube-system on Tuesday May 13, 2025 @04:24PM (#43977298)
Birthdates are frequently asked in US health settings not as a protection against attack, but as a protection against mistake.

They are not worried that someone is going to come in, and steal your appointment. They are worried that someone with the same name as you might show up on the same day and the doctor might treat the wrong patient with the wrong information.

This is an completely different risk profile than a form on the internet.

Re:Why are banks still getting authentication so wrong? by TylerE on Tuesday May 13, 2025 @05:18PM (#43977850)
This is a realer problem than some realize.

I have the same name as my father (first and last, , different middle). We live at the same address. It’s a small town so we share a lot of the same doctors. We use the same pharmacy.

For just a bit of extra spice are birthdays are only two days apart.

Re:Why are banks still getting authentication so wrong? by pixl97 on Tuesday May 13, 2025 @10:40PM (#43980165)
This is how we unintentionally found a relative of my former girlfriend. Went to a small pharmacy to pick up medicine for DF, where the F is a really weird last name. They were like I just filled that, reached back and grabbed it and set it on the counter. I noticed it was the wrong address...

A person she hadn't seen or talked to in 20 years had moved to this town neither of them were from and named their kid the same name.

Re:Why are banks still getting authentication so wrong? by InitialLastName on Wednesday May 14, 2025 @12:55PM (#43986735)
For sure, my dad lives in the same town as someone with the same (relatively uncommon) name as him who is roughly the same age. This causes confusion all the time with local services and organizations (especially since the other guy has had some, err, unflattering encounters with the legal system).
Re:Why are banks still getting authentication so wrong? by dogmatism on Tuesday May 13, 2025 @08:55PM (#43979576)
They also should be specific to ask you to say it, not confirm what they say

Because I have literally seen this go wrong: “Mr John Smith, you’re here for procedure X, yes?” “Yes” Some other provider overhears: “I thought that was Mr Jones for procedure Y” “Are you Mr smith or Mr Jones?” “Mr Jones” “Then why did you say yes when I asked if you were Mr Smith” “I assumed you knew best”…

People do weird things in healthcare settings

Re:Why are banks still getting authentication so wrong? by SoftTalker on Tuesday May 13, 2025 @06:03PM (#43978269)
Yeah but nobody really cares about your health info. They care about your bank account info though.