I don't think that person that commented on your reddit post accurately understands the article they linked. From your description this doesn't seem like passwordless auth.
this post was submitted on 03 Mar 2024
33 points (92.3% liked)
cybersecurity
3238 readers
1 users here now
An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!
Community Rules
- Be kind
- Limit promotional activities
- Non-cybersecurity posts should be redirected to other communities within infosec.pub.
Enjoy!
founded 1 year ago
MODERATORS
Well technically there is no password… but it’s not what passwordless auth is supposed to mean
It's password and MFA with your Pin acting as a super duper insecure password.
Ok, email is terrible. It just offloads the onus of security to your email provider. SMS/Phone call however meets the “something you have” aspect of MFA, PIN now counting as “something you know” aspect. Ultimately it sounds super weak, but that weakness can be mitigated by other aspects such as device fingerprinting, geo blocking, locking out after failed attempts, etc.
The thing is, at some point, the bank will have a customers account get breached no matter what they do. If they want to be lax on security, they better provide top notch customer service when a breach occurs because they’ve taken the onus of security off the account holder and limited their options on being more secure.
I would argue that a phone number barely counts as “something you have” because of how easy it is for attackers to gain access if they really want it. It’s more like “something your cellphone company has and lets you use”. I would rather have email 2FA over SMS because that account actually has a strong password and real 2FA on it. The truly terrible part is you can’t disable either auth option so any attacker has two attack vectors.
Sim swapping is stupid easy and common
Sms 2fa is not real 2fa. My non techie buddy's business got hacked, he got got for over a hundred grand.
If banks have some top notch backend security checks, then WHY do so many not let you choose a fucking user name? I absolutely DESPISE any bank that makes me use some dumbass customer/account/user number like 94023382 that I'm NEVER able to remember and always have to go scouring my house for some old paper statement.
But would I stop using a bank (as I've seen suggested in the past) solely due to their password policy?
I have.
Yeah, no, I would not stand for that. I would be switching banks as soon as possible.
Sometimes you just have to walk away.
huh didn't take them that long to devolve into another stack overflow it seems.
Switch banks. I recently did so too after the previous one tried to force a TAN app on me without any way to use a physical generator. Security part aside; I use a custom OS on my phone and these stupid banking apps all love their safety net checks.
New bank was able to just send me a generator and everything works fine.