Hacker News Reader

The amazing thing is with Wells Fargo that if you have a RSA SecurID 2FA FOB for access to your bank accounts, and you have a phone number configured for the account, you can use EITHER the 2FA RSA one-time pin, OR SMS verification to log into your bank account web page.

I mean this is a bank, are these guys for real?

View on HN

Yes, although there is actually a lower transaction limit on sessions initiated with SMS 2FA vs SecurID.

Which almost furthers the point that this is bad, isn’t this an acknowledgement by them that SMS 2FA is less secure? If it’s less secure and you have SecurID, why can’t I disable SMS?

There is support cost for disabling sms. While you may be technically inclined to be comfortable with disabling sms, they have to balance the cost of hacking vs support cost for all users.

Thats really bad. Chase doesn't even offer the option of non-phone 2FA

Reply on news.ycombinator.com