Post #4395712

2026-08-05 21:21 UTC

I love when banks require you to do extra security/2fa on specific actions (like sending money), but they're the same 2fa you have to do to log in. so I enter my username/password, it sends an SMS to my phone, I enter the code, I click into "send money", select my landlord, type in the amount, click send, and it sends a code to my phone, I type it in again. the two texts came in 30 seconds apart. why are you re-authorizing me less than a minute later?

Replies (3)

@foone@digipres.club 2026-08-05 21:28

it was me 30 seconds ago but NOW it might be someone hacking my account! you know, someone who has access to my passwword and phone, but has lost it in the last 30 seconds

Open ##4395711
@Xavier@infosec.exchange 2026-08-05 22:19

@foone@digipres.club poor programming and the complexity of banking stacks. Knowing when to use step up authentication is hard enough. But its crazy how most banking apps are a dozen or more third party apps on the back end.

Open ##4396944
@tbortels@infosec.exchange 2026-08-05 23:08

@foone@digipres.club The Zeus trojan used to lie in wait watching for a banking login, then launching a second session in the background using your existing fresh session cookie. You log in and do whatever - and it's in the background transferring your funds away. The second MFA is intended to confirm that it's still you doing the transaction and not a bot that stole your session. There are better ways to auth and secure a session now, but those kind of countermeasures tend to get written into policy, especially in places like banking, and are requirements long after they cease to be useful.

Open ##4398371