[HN Gopher] Ask HN: Bank with Yubikey support?
       ___________________________________________________________________
        
       Ask HN: Bank with Yubikey support?
        
       Yesterday I got an SMS 2FA text from my bank for a login attempt
       that I did not trigger. I changed my password, alerted my bank, and
       have been checking my account balance every few minutes it seems,
       but luckily everything seems fine.  The experience got me thinking,
       because the SMS 2FA was seemingly the last defense saving my
       account from a breach. My bank doesn't offer a stronger form of 2FA
       --neither TOTP nor any form of U2F.  Meanwhile, I really love
       Yubikeys; I have one plugged into every laptop I own (work and
       personal). I use Touch ID or Face ID on sites I access frequently
       from mobile.  It seems that the one place where U2F would be really
       impactful is online banking, but I've struggled figuring out which
       banks support strong 2FA without first creating an account with the
       bank.  Does your bank offer U2F, FIDO2, WebAuthn or any other form
       of hardware security token mechanism for logins? Have you had
       otherwise positive or negative experiences with the bank overall?
        
       Author : jez
       Score  : 23 points
       Date   : 2022-04-27 18:20 UTC (4 hours ago)
        
       | greenie_beans wrote:
       | wouldn't it be nice if we could see the relevant part of the
       | server logs when this happens? it would cut down on my paranoia.
       | at least give me an ip address even though it's probably
       | worthless.
        
       | RockRobotRock wrote:
       | I bank with Chase, and their passwords aren't even case
       | sensitive.
        
       | ed_db wrote:
       | Regarding the UK here is a similar discussion on reddit
       | https://www.reddit.com/r/UKPersonalFinance/comments/r7vvcj/w...
        
       | GloriousKoji wrote:
       | The ONLY financial institute I trust with large sums of money and
       | supports yubikey is Vanguard.
       | 
       | Also check out the list of works with yubikey, but it's super
       | short and most of them are for crypto:
       | https://www.yubico.com/works-with-yubikey/catalog/?usecase=1...
        
         | whitepoplar wrote:
         | Last time I checked, Vanguard's implementation is worthless
         | because you can still request an SMS code as an alternate path.
        
       | dzhiurgis wrote:
       | How about modern e-banks like wise and revolut? They have tons of
       | features and generally use mobile app for auth (not exactly same
       | as yubi but way better than SMS)
        
       | gshakir wrote:
       | Bank of America offers it. It works great, but it works only on
       | desktop not on IOS app.
        
         | tanelpoder wrote:
         | But they still allow using 2FA via SMS too, even if a yubikey
         | is configured. And there's no way to turn the SMS auth off
         | (last time I checked).
        
       | toomuchtodo wrote:
       | Morgan Stanley and BoA.
        
       | guenthert wrote:
       | Solution in search of a problem or just plain advertising? I
       | rather see banks use some sensible authentication standard
       | (perhaps, not necessarily, 2FA; likely, but preferably not using
       | passwords), then a random for-profit company's product. Yubikeys
       | are first and foremost baffling expensive.
        
         | RockRobotRock wrote:
         | You think YubiKey needs to advertise on a message board for
         | paranoid tech nerds?
         | 
         | nobody just found out about yubikey from this thread...
        
       ___________________________________________________________________
       (page generated 2022-04-27 23:03 UTC)