In "Wait, why doesn't literally everyone do this?", we implemented something where, if you request a call from your Stripe account, it shows you two random numbers.
When we call you, we read you the first number (to prove that we're Stripe) and then ask you for the second.
When we call you, we read you the first number (to prove that we're Stripe) and then ask you for the second.
The traditional way of doing this is a multiple-step handshake where neither party is entirely comfortable saying all of the information used to handshake until *after* the handshake is complete successfully, which is just terrible.
You can imagine extensions of this to authenticate e.g. bank agents when they call you.
"Do you have your online banking open? Great. Hit the S key four times; you'll see a message saying that a banker needing to talk to you will be able to quote a number. Can you see that?"
"Do you have your online banking open? Great. Hit the S key four times; you'll see a message saying that a banker needing to talk to you will be able to quote a number. Can you see that?"
Beats the heck out of "Call the number on the back of your credit card then ask for an internal transfer to Patrick on desk #63524 please."
