undefined | Better HN

0 pointsanlif9y ago0 comments

The same idea is used in Norway. Most banks and public services (e.g. tax returns) use this system for online two-factor authentication.

[1] https://www.bankid.no/en/

0 comments

shshhdhs9y ago

Didn't NIST just say two factor via mobile is a "bad idea"? Have Norway or Estonia responded?

EDIT: Thank you whoever downvoted an honest question that added to the discussion

brainfire9y ago

The bad idea is being sent a (potentially interceptable) SMS with a code.

The Estonian method is described as using a private key present on the SIM card, just like a normal smart card used for authenticating/signing.

candiodari9y ago

That's how every bank I know in Australia, at least 2 US banks and 4 European banks do it. Transfer (sometimes login too) ? Code over SMS.

Besides, pretty much all banks simply use 2 or 3 factor authentication as an anticompetitive tactic (half the businesses in most countries pay the banks 2-300$ per month just for scheduled download of transactions)

captn3m09y ago

I think that was for SMS, not specifically mobile.

j / k navigate · click thread line to collapse