Hacker News Reader

Comment by AshamedCaptain | Hacker News Reader

For a lot of time I've been trying to find e.g. a bank that would not basically require an Android or iOS device for me to shop online. Many of them even have "root detectors" which basically means these programs won't work in "rooted", "de-Googlefied" and/or free Android implementations. After some complains the only thing I managed to get is for them to fallback to SMS 2FA which at this point I consider a blessing.

I've already said this numerous times here on HN, but it is a dark future we are getting into. The only thing that came remotely close to this level of "you require this proprietary software for daily life" level of danger was ActiveX.

View on HN

You're not wrong, but it's real problem, both technically and socially, without much in the way of a good solution. Android and iOS provide significant security by virtue of the chain of trust running starting with Google or Apple down through their software and hardware (Google is a bit special here, I'll admit).

This makes it easy for businesses like banks to work with those ecosystems and provide a secure experience without inventing much themselves. What's the alternative? SMS 2FA is abysmal. Maybe they could provide you a configurable webhook, but now they don't control the experience, and that's part of their requirements. Not to mention I wouldn't trust a bank to implement webhooks correctly.

The problem is we're becoming sophisticated enough as a society that we are forced to rely on a few establishments to maintain that sophistication. Whether it's for chain of security, microprocessors, springs in our toasters, it's not possible to keep everything open and interchangeable while maintaining our current way of life.

I'd love that, but it's not realistic, as far as I can tell.

> What's the alternative? SMS 2FA is abysmal.

There are cross platform MFA solutions that could be supported. Your guess is as good as mine as to why banks don't support them.

> SMS 2FA is abysmal

Is there actually anything wrong with SMS 2FA, other than SIM swapping?

SIM swapping isn't a problem with SMS so much as the phone carriers, who really need to put stricter processes in place for verifying account transfers. IMO, they deserve most of the culpability.

In Scandinavia we have BankID which kind of uses SMS, but not quite. When I try to authenticate it sends a message to my phone and then I have to type in my 4-8 digit pin code on my phone. Apparently they have put a tiny application on the sim card, so sim swapping isn't an issue. Whenever I get a new sim card I have to authenticate the sim card using my hardware token and password.

Finland I got sometimes SMS in flow. For bank login it is account and password, then one time code. Then when making transaction getting SMS with which one time code to enter. And then when paying with confirmation same thing but just with SMS code.

I don't really see point of SMS in flow, but hey I can somewhat live with it.

Have only a small amount of money on you regular account for the everyday means, with all the money on another account whatever.

Lose your wallet with cards, lose your phone (or just a phone with Apple/GooglePay). Get a replacement SIM, be locked out of receiving any SMS for 24h[0]. Now be somewhere where is no local branches of your bank.[1] Or even better - be abroad.

Or just be in a taxi at 9PM when no one works and the bank locks you out - just like when it happened to me. Gladly I found an ATM where I could withdraw from a secondary account.

[0] Actual practice of cellular operators in my country. Safety

[1] Even better with the virtual banks without any.

Isn’t this a problem with _any_ type of 2FA?

I agree insofar as, this is exactly why I strongly believe that 2FA should always be optional. But, if the user has chosen to use 2FA (or has not opted out), what’s wrong with SMS?

> Isn’t this a problem with _any_ type of 2FA?

Not quite because if you lose your YubiKey - you just lost your YubiKey, you still have the ability to call the bank (and my bank knows my number, so they greet me by the name) and at least do something, in the situation I've got in the previous comment I could lift the lock out with the code word, only if I could recall it then.

But the phone is not only your 2FA item, it is also your "virtual identity" now for too many services, banks included. And with the tendency of banks to shoehorn you to their phone apps this starts to get ridiculous, if you lose your phone you are now:

lost your banking app (2FA with push)

lost the ability to 2FA with SMS as a backup

lost the ability to install the app on the new phone (oh hi $username, it is really you despite you just gave your $username@gmail.com and password? We sent you an SMS to confirm it is really you, FOR YOUR SAFETY)

lost the ability to login to your bank account on someone's else phone (same shit with SMS to your phone number)

Bonus points: if you lost your ID or doesn't have it on you - you can't restore the SIM with your number. Or even buy a new one in many cases.

> But, if the user has chosen to use 2FA (or has not opted out), what’s wrong with SMS?

Pfft. I was forcefully shoehorned to mandatory SMS 2FA by my bank. I've opted out of this some years ago and it did work... till I was 600km from my home, I needed to buy the train tickets, I tried to logon to the bank webapp to move the required amount to the primary account only to discover what they enabled 2FA without asking. And the phone where my SIM (known by the bank)[0] was installed was literally on it's last 10% of charge in the airplane mode. It could literally shutdown just from the act of disabling the airplane mode so I could receive the SMS.

So if the problem is not with SMS 2FA. The problem is what nowadays "SMS 2FA", at least for the banking apps[1], is way, way more than just SMS alone.

[0] I'm not sure if they monitor IMEI of the device, but I wouldn't be surprised, considering they receive the notification of the changed IMSI.

[1] Not sure how these practices are widespread world wide.

Phone carriers deserve culpability because unrelated companies use them for purposes they are not supposed to be used for?

They deserve culpability for letting someone else receive my private text messages. It doesn’t matter whether those messages contain one-time passcodes, intimate conversations, or critical business data—they were intended for me and no one else.

Before the "standardization" on SMS first and later on Google/Apple systems, there were a number of methods, since banks did try to do R&D to cut out on fraud:

* One-time-pads (yes, I had a bank that would give me a card with 50 codes you were supposed to use once, then go back to the branch for more. Didn't last long, though, and was replaced with:)

* Reusable codes: bank gives you a card with 50 codes. Bank randomly asks you for code number X. X may eventually repeat over time. (Bank also tells you your specific card serial number so that you can identify them).

* Credit cards housing an actual e-Ink display that would give TOTP codes. https://www.e-ink-info.com/e-ink-used-create-dynamic-cvv-cre...

* Actual FIDO devices.

My bank issues a fido device: a card scanner with a built in camera that reads qr codes. Excellent tool, but for a few years now the bank is actively discouraging its use, touting the benefits of apps instead. It costs them around 60 euro to issue the device, and, sadly, thats incentive enough to advocate less secure solutions. When they take it away from me, I am out of options as this is the last bank in my country that issues them to individuals :-/

Rabobank? Yes it’s nice but I always find it a pain haha. 60€ wow, when they were first send around they very easily gave me 2 extra to put at work etc.

What about N26, I don’t remember needing the app and I can log into a website. Not sure though…

Not really a technical challenge. You could force an equivalent of POSIX, maybe based on WASM, that smartphone makers would be forced to support if they want to sell in your region, and forced to support side loading those apps, as no government should be subject to the caprices of the various app stores. At this point smartphones have a fairly mature feature set to expose to the app. That would also help with the anti-competitive app store practices.

"What's the alternative? SMS 2FA is abysmal."

It seems to be forgotten that email 2FA exists.

I can't quantify the risks relative to SMS 2FA because there are such broad ranging implementations but given the broad adoption of gmail, how many people can really snoop unencrypted email traffic at backbone chokepoints ?

There are many cases where I would be perfectly happy with the risk profile of either SIM swap attacks or email interception.

The main problem with email 2FA is that if someone gains access to your email account, they can reset your passwords on many sites and services. They can then bypass both the password (by resetting it) and the 2FA (by simply reading your emails).

Even better, if you re-use passwords, they can use one password to access your email account and the service, and get the 2FA token via email.

if someone gets access to your phone they can do way more damage, but this is accepted.

It's a lot easier to compromise an enormous purchased batch of email addresses than it is to do SIM swapping attacks on that scale

One thing that can and must be fixed instantly is to legislate that these businesses can not deny their services to anyone, just like systemic banks and the post office.

Why is SMS 2FA abysmal?

Can't your number be spoofed?

> The problem is we're becoming sophisticated enough as a society that we are forced to rely on a few establishments to maintain that sophistication.

Come on, we have open webbrowsers, which are 100x more difficult to implement than a chain of trust. Surely, somebody could come up with a reliable alternative.

Can't you just use a credit card?

Every time any HN discussion veers toward alternative smartphone OSes, for instance, people come out of the woodwork to talk about how they just couldn't possibly access their bank without an Android or iOS device... what are you all doing with your bank so often? I log in a couple times a month, from my PC, to check balances and pay my car loan. I've certainly never needed a damn app.

Most banks in the EU require 2FA _every time_ you use a credit card online, due to a EU directive: https://en.wikipedia.org/wiki/Strong_customer_authentication

Yeah. My TSB bank recently implemented this: - enter credit card details on the website - got to the mobile app, enter second password - receive an SMS to my phone number with 2fa code - login into the app, approve the payment - enter first account password - go back to the website and click continue

That’a all together with iOS FaceID enabler. Monzo is actually way simpler.

I've started using MobilePay — the Danish send-money-to-anyone-with-a-phone-number system — rather than a debit/credit card wherever it's offered.

I've usually provided my phone number already, as part of the delivery address, so it's a click to choose MobilePay, another to confirm the number, then I fingerprint-unlock the MobilePay app and swipe to confirm the payment request that appears.

It's not really "send-money-to-anyone-with-a-phone-number", it's "send-money-to-anyone-with-the-mobilepay-app-installed" - and it only works on iPhones and unrooted Android phones with Google services enabled.

As someone who doesn't have it, it's very rapidly become the thing that makes me feel the most like a second-class citizen.

It would be nice if they'd also implement it using online banking.

The British version (PayM) isn't used much, but at least you can add a phone number to your own account within normal internet banking, and send money to a number linked to an account without using either side using an app.

Not literally every time, it has a value threshold (also depends on your previous relationship with the vendor, I guess)

So, for most purchases it just doesn't trigger

Not in the EU. I pay for a lot of nonrecurring things via money transfer and I need a TAN for every online transaction. Before mobile apps they would occasionally mail me a list of like 50 of them [1] but that's not a thing anymore. Every online credit card transaction has to be confirmed in the banking app as well.

1: https://en.wikipedia.org/wiki/Transaction_authentication_num...

I don't have a credit card but sometimes I can't even buy a game on Steam without using a damn app. Trying to shop online has turned from nightmarish to impossible without these apps in just a couple of years.

I tried using the site of my bank but I could never make it work. There's no fighting it and it sucks.

Are you suggesting the parent rely on one US-based oligopoly to avoid using another US-based oligopoly?

My bank doesn't seem to do root detection. I haven't tried it on a phone without at least microgapps but I'm pretty sure that it just works. Even on LineageOS with root I never really had any problems.

I do recall seeing a popup at one point ("hey we see you've done some weird shit to your phone, call us if you don't knowewhat rooting means" or something like that) but that's really just about it.

I should try running it in Anbox, come to think of it. Would be a fun experience.

If you're a developer in the EU and you think you can do better, the PSD2 system is set up to allow for fintech solutions like these. You'll need to get the necessary documentation in order, or even a license, to get access to actual banking APIs (thank goodness) but from that point on you should be able to write your own app. You'll have to be very careful, though, you don't want to anger the financial regulators.

Which bank is that? My bank sees weird shit on my phone, it shuts down with no error message. I want in.

Your mileage may vary, but https://ing.nl/ has been working great for me. Probably not as good outside the Netherlands.

https://https://play.google.com/store/apps/details?id=com.in...

Also, I tried running the app in Anbox but there's no x86 build of the APK and Google's ARM Android emulator is just broken these days, the VM doesn't even boot.

Bunq's app works great on GrapheneOS without any Google services installed whatsoever.

Maybe there’s a market for dual-OS-installation smartphones, as an extension of dual-SIM ones.

In case you are still looking for a card that will work without an app, American Express sends you emails and SMSs with validation codes for online purchases.

FWIW, Bunq's app works on GrapheneOS without any Google services installed whatsoever.

Reply on news.ycombinator.com