Hacker News Reader

Comment by skunkworker | Hacker News Reader

And yet my bank (Chase) only supports email and sms 2fa with no option for OTP/TOTP. Is this just a institution dragging their feet or are there more regulatory reasons why they won't allow more secure authentication?

View on HN

At least they offer codes via email. I can (and do) secure access to my email account and domain registration with a very long password and a Yubikey. That’s “good enough” for my purposes.

"secure" and "email" really do not belong in the same sentence.

Most email is unencrypted during transit, so a state level adversary can still easily intercept it. For most people this is however sufficient.

Absolutely, a state-level opponent could get up to some shenanigans though I would argue that a state has much easier methods to go cracking into my Visa card. My threat model doesn’t include nation states targeting me specifically because, simply, if one comes after me I am screwed anyway.

As for email being unencrypted, I think most of it now is encrypted during transit (thanks to the Big Two providers knocking points off a spam score if a message does come via TLS) and even if it weren’t the password is also not known so the second factor is not useful. For example, I just tried to log in to chase.com and the code they emailed me at 1752 MST is 067315.

If I’ve been phished so hard that posting this is useful, again I’m screwed.

You hardly need to be "state-level" to spoof bgp or dns.

I asked them over twitter back in may.

https://twitter.com/skunkworker/status/1131297869703438337

For anyone who wants a US bank with TOTP, schwab works! I was pleasantly surprised to discover this. It uses some symantec stuff (as did paypal earlier), but it's TOTP underneath and can be used with any TOTP app.

There is even a "Use Token" button on the Chase login page, but apparently only business accounts can use it.

at least one of my banks cannot SMS me codes, I can't remmeber which, so I always forget, try it, and have to select another method.

I THINK it's chase, but I'm not sure.

They have my correct phone number, but for years now, the code just... never shows up.

Are you using Google Voice? I have the same problem with Chase on my GV number. Calling works fine, and so does email, but no SMS.

Port a number to GV, it will work, but you are at risk of losing it if you don't log in often enough. I lost an important number that way (along with my grand fathered free google apps account for my domain)

I have few personal google apps grandfathered account, & I think it sends an email to all admins if you do not log into it for about 10 months.

It’s more to make customers feel better than for security.

Reply on news.ycombinator.com