Hacker News new | past | comments | ask | show | jobs | submit login

I wonder why OP hasn’t mentioned CAP schemes [1], which I’m sure has to exist in the US, too?

For example, I’m using a domestic CAP-like system (dubbed Secoder in Germany) for several of my bank accounts. It exploits the fact that your ATM card is a trusted computer with a built-in digital signature/HMAC feature.

You have to spend 20 € for a small battery-powered device, which features a card reader, a display, a PIN pad and a camera. (There’s also a USB-based variant without batteries and camera.)

On each online transaction, you insert your card and point the camera at the QR-encoded challenge on your computer screen. The display then asks you to confirm recipient and amount, and if you do, it sends the whole thing to the ATM card, which then shows you the 2FA code based on HMAC.

CAP seems to have become a niche thing as everyone is preferring apps nowadays, and those are much cheaper to maintain. I still think the CAP system is superior to apps, because it’s offline, carrier-independent and easy to use.

[1]: https://en.wikipedia.org/wiki/Chip_Authentication_Program




> which I’m sure has to exist in the US, too?

Considering that they haven't deployed chip cards until mid-2010s it's unlikely that this even exists (and indeed this was not available on any US banks).


The main problem that OP is experiencing is that the services that they need to access only support SMS 2FA. Talking about a different unsupported scheme doesn't seem relevant.


Good point. One might argue though that you could switch to a competing bank which does support that scheme.


This may work for some services but there is going to be at least a few that are hard to replace and only support SMS.

At least in my experience trying to find a Canadian bank with reasonable 2FA they were all either SMS or a custom app. So I just sucked it up and stuck with my current one because there was no choice.


>camera

What is it used for?


It’s used for scanning the QR code displayed on the computer (or phone).

The QR code contains:

- the monetary amount,

- parts of the recipient’s account number (both helps thwart MITM attacks)

- and a random challenge (which helps prevent replay attacks.)

That’s for the wireless model. Wired CAP devices don’t have a camera since they can use USB.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: