This is definitely a big topic and one worthy of some attention.
It’s funny though, I haven’t given it much thought in a long time, and especially didn’t see Neo as a problematic service in this regard, because compared to the Canadian landscape (I know Europe was decades ahead though, decades ago), especially to how it was maybe 10 years ago, Neo’s login was/is actually by far one of the better ones as far as banks go when I first signed up. While most companies dealing with far less important information were offering the security methods you describe, banks were often using passwords of max 8 chars with most special chars forbidden, (as opposed to a min of 8 or more with a requirement for more variety), and SMS f2a at best, if even at all, which it often was not. Neo at least allowing (requiring even) a real password, and 2fa (even if it is just SMS), stood out at the time, wildly enough (though most have improved by this point thankfully!)
But, like you say, it could stand to progress for sure. Just because it was once far better than the competition doesn’t mean it still is, or that it was ever actually good to begin with.
That said, banking, government services, and things like this are a tricky case. I’m a huge proponent of encrypted services with secure login methods such that if you don’t have your credentials, the data may as well not exist - there’s no work around, no rear service entrance; the account and data is just gone. That works for less important things, and/or people who can manage their credentials well enough to handle that safely, but for most people, and especially when it comes to banking, this would be a greater threat to them(selves) than they face from potential attackers. The option to permanently lose your life savings because you forgot to backup a passcode or didn’t have a secondary device, etc. would probably not fly with most.
Of course, that’s not to say though that they already have the best system and can’t improve - just that the “end state” may always look a little different than it will for other services. I alluded to the European option at the start and they have had physical 2fa code keys (basically the 6 digit code you get in an app, but instead of an app, it’s a physical pager-like device) for ages now, so clearly it is possible to handle things securely without running into issues.
Semi-related Rant
Although it’s a bit of a tangent, this is related to a broader society-wide issue that I think gets far too little attention for how serious it is. If you’re up for a read, allow me to begin:
Whether people have stopped to think about it or not, most people (I think) would easily understand and agree with the following ways you could label or break up types of data:
Public vs Private
- Public: things that others might know, or even need to know as part of people interacting and living life normally
- Example: your address, phone number, perhaps your face or name
- Private: things only you know, and are only needed to facilitate services or verify identity, but would never have a reason to be shared socially
- Example: your password to a website
Meaningful vs Meaningless
- Meaningful: info that inherently carries information
- Example: an ID code like 42-07-510 that the company created because you were 42 years old when you joined, joined in 2007, and are the 510th customer
- Meaningless: info that may or may not unlock other information, but by itself is just (for example) a random, meaningless string of numbers and/or letters
- Example: an ID code like 62-41-607 that the company randomly generated for you that doesn’t mean anything
Changeable vs Inherent
- Changeable: things like a password that you can just change at will without any impacts or friction
- Inherent: things like your phone number, address, name, fingerprints, face, or birthday, that at best, you could change only with difficulty and significant inconvenience, and at worst, cannot change at all
With that established, identification verification should only ever use private, meaningless, changeable information!
You wouldn’t need to worry about sharing your address, birthday, or phone number, since no one could do anything with it. You wouldn’t need to worry about your ID information leaking because - unlike those - you could just change it, like a password. You wouldn’t need to worry about revealing excess or unnecessary information by signing up to something because the ID method would be meaningless (as described above).
If you try to use public information like your birthday, address, a mother’s maiden name, etc. for identification,
- it creates pressure to keep that information private, which is inconvenient at best, and impossible at worst, lest it leak out and be used against you, and
- it accomplishes nothing to prevent fraud or actually prove identity, because this information was not previously considered private, so you cannot start using it for private purposes now, because it was and is already “out there” and thus could be learned and used fraudulently by attackers
If you try to use inherent information like your address, face, fingerprint, phone number, birthday, etc. for identification,
- If it leaks, you can do little or nothing to change it, so it remains out there, posing a risk to you forever, unlike a password that can be changed so no one with the leaked code can use it
If you try to use meaningful information like your address, name, birthday, etc. for identification,
- there is an inherent privacy loss in that exchange
Despite this, most of society is structured around doing exactly these impossible and illogical things for identification, which makes it no surprise how rampant identity theft is, and why people are constantly in a panic about their sensitive information, data leaks, etc. If systems were designed correctly, these concerns would not exist. Your password gets leaked? No worries, you change it before it can be cracked and go on with your day. Your “sensitive information” like your birthday or phone number got leaked? First of all, not really, because surely that was already out there if you’ve ever interacted with another person, and second, too bad, now you’re just [in trouble] since there’s nothing you can do about it!
To tie this back to the original post, consider the SIM-swapping threat mentioned. A bad actor can go to your phone company/mobile carrier, pretend to be you, and get them to hand over a new SIM, so all your messages and calls now go to them instead of you, thus allowing them to steal your SMS 2fa code(s). The only reason this works and is possible is the phone company was probably asking public information like your address, birthday, name, phone number, etc. to “prove” that the person in front of them is you, but, because none of that information is private or remotely suitable for identification in any way, the bad actor was easily able to acquire and abuse it to pull off this stunt. With a correctly designed system like I’m describing where people are identified not by things anyone could look up about them, but instead by meaningless, easily changeable secrets that only they know, this would not be possible.
The thing is, basically every website and other technology already more or less works correctly, and did from the beginning - it’s mostly public/government services that are the problem, along with any legacy-style services like perhaps a mobile carrier. I can only assume it’s a holdover from a time when no one thought or cared about any of this because no one was trying to be malicious with it, but times have changed and these systems need to be modernized. I know it’s not a Neo problem, or something any one person or group can fix on their own, but perhaps with more people thinking about this, one day, we’ll see progress.
