I love when banks require you to do extra security/2fa on specific actions (like sending money), but they're the same 2fa you have to do to log in.

so I enter my username/password, it sends an SMS to my phone, I enter the code, I click into "send money", select my landlord, type in the amount, click send, and it sends a code to my phone, I type it in again.

the two texts came in 30 seconds apart. why are you re-authorizing me less than a minute later?

@foone In a past life I worked at an ISP where if we *called the customer back* (EG: rebooted their modem, call dropped) we'd have to re-authenticate them completely ( First + Last, Address, Phone #, etc)

Fifteen years on, I'm still baffled as to why. It's *the same number* they called us from, etc

@CursedSilicon I mean, I guess in the landline days, you could end up talking to someone at the same location but not the same person?
like my doctor rechecks that for HIPAA reasons. but yeah, I don't know why an ISP would need that much security

it was me 30 seconds ago but NOW it might be someone hacking my account!

you know, someone who has access to my passwword and phone, but has lost it in the last 30 seconds

I should make a 2fa keyboard, where you have to fill out some kind of 2FA for each key you type or it won't be accepted

and which one it'll accept per letter changes

H (enter the code sent to your SMS)
E (press your yubikey/U2F)
L (enter your Google Authenticator code)
L (press your fingerprint scanner)
O (face scan)
_ (click the link in your email)
W (upload a scan of your license)
O (webcam-based age check)
R (approve the push notification on the mobile app)
L (browser passkey)
D (mother's maiden name, first pet, highschool mascot)

unfortunately I wasn't able to send the message because I couldn't find my RSA SecurID for the enter key

@foone Was sure dumbpasswordrules had an example of a similar hell that just popped in my head: Websites with keypads you *have* to use to enter password/code/…

https://dumbpasswordrules.com/sites/banque-de-tahiti/ (of course this one's a bank too)

@lanodan terrible. and what if my password has keys I can't type on that keyboard? there's no key for Æ!

at least when I'm on mobile I think my bank will let me log in with my fingerprint and THEN it'll do the SMS 2fa on the send-money.

but on desktop, it's just "do SMS 2fa twice"

@foone
the way my bank does it uses either a physical hw device or a phone app which shows txn details so you can verify them against what the site says, which is also like the sole layer of phishing defense given that they discourage password managers

@foone Sounds like it's time for a Yubikeyboard. Where every key is also a separate Yubikey.

@jimp I'd love to do it, it'd just require more money than I've got, or source of free yubikeys