Strong Customer Authentication - **Now delayed** changes to online verification

DragonQ

So HSBC & First Direct are the only ones to not allow OTP to login. Definitely won't be using them for anything day-to-day then. I like that the Lloyds Group banks (and TSB) allow OTP to a landline too.

eskbanker

DragonQ wrote: »

So HSBC & First Direct are the only ones to not allow OTP to login. Definitely won't be using them for anything day-to-day then.

Are you seeing the HSBC/FD 2FA model as less secure than OTPs?

Ergates

DragonQ wrote: »

So HSBC & First Direct are the only ones to not allow OTP to login. Definitely won't be using them for anything day-to-day then. I like that the Lloyds Group banks (and TSB) allow OTP to a landline too.

The EBA have declared that OTPs do not meet their security requirements for PSD2. Unfortunately, they declared this very late in the day, *after* most banks had already built their 2FA systems using OTPs.

So, expect to see more banks moving away from OTPs.

masonic

DragonQ wrote: »

So HSBC & First Direct are the only ones to not allow OTP to login. Definitely won't be using them for anything day-to-day then. I like that the Lloyds Group banks (and TSB) allow OTP to a landline too.

HSBC and First Direct both use OTP. Specifically they use time-based OTP or TOTP using a device, which is the preferred implementation. You have the choice of activating it through their mobile app or a physical device ("secure key").

SMS-based OTP has had its days numbered since 2016, when the NIST pointed out its flaws. Good to see the EBA catching up at last, and eventually the FCA is bound to follow suit. The only reason it has been so widely adopted is it is convenient, but convenience is the enemy of security.

mro

masonic wrote: »

HSBC and First Direct both use OTP. Specifically they use time-based OTP or TOTP using a device, which is the preferred implementation. You have the choice of activating it through their mobile app or a physical device ("secure key").

SMS-based OTP has had its days numbered since 2016, when the NIST pointed out its flaws. Good to see the EBA catching up at last, and eventually the FCA is bound to follow suit. The only reason it has been so widely adopted is it is convenient, but convenience is the enemy of security.

Until security becomes too much, inconvenient & over the top.
.

mro

Will Brexit affect rollout ?
.

eskbanker

mro wrote: »

Will Brexit affect rollout ?

Not unless this UK government (or a future one) independently chooses to repeal the Payment Services Regulations 2017 and I imagine they'll have somewhat bigger fish to fry....

masonic

mro wrote: »

Until security becomes too much, inconvenient & over the top.
.

Well not really. You can have perfect security when when a product becomes so inconvenient that nobody can be bothered to use it.

Doc_N

masonic wrote: »

Well not really. You can have perfect security when when a product becomes so inconvenient that nobody can be bothered to use it.

Which is the point that was being made. And some products are fast reaching that point for some of us, perhaps.

masonic

Doc_N wrote: »

Which is the point that was being made. And some products are fast reaching that point for some of us, perhaps.

The point I'm making is that designers of such measures won't see it as a bad thing if some users reduce, stop or change their usage of vulnerable systems as a result of tightening security as this will just reduce the potential for fraud via those systems even further.

I've never supported the use of SMS for authorising transactions - that's a clear case of convenience compromising security. Contemporary email is more secure than SMS, and no less convenient, while authenticator apps are ubiquitous and much more secure, but devices must be made available to those without smartphones - and it's the inconvenience of that which has led the banks to compromise on security.