6 ms·
My bank uses the banking app for auth if I try and login via a browser.
by Gee101 11mo ago
My bank uses the banking app for auth if I try and login via a browser.
- HPsquared 11mo agoBarclays in the UK offer (or used to) a hardware device with a keypad allowing the user to do a challenge-response using the bank card's chip and PIN. Not sure if they still do, though. Edit: https://en.wikipedia.org/wiki/Chip_Authentication_Program https://en.wikipedia.org/wiki/Chip_Authentication_Program
- array_key_first 11mo agoThat's because they're stupid or doing something suspicious, probably both. There's legitimately zero reason to allow 2FA only on your own propreitary app. You can't even make a financial argument - allowing other TOTP methods is cheaper because now you don't need an app!
- weikju 11mo ago> That's because they're stupid or doing something suspicious, probably both Small comfort for whoever needs to use that bank. This is the disconnect geeks and Free Software needs to bridge to make any headway.
- exe34 11mo agoit costs basically nothing to change banks. you sign up to a new one and they transfer your account and direct debits. you just tell your employer where to send your next salary payment.
- weikju 11mo agoSometimes it’s more complicated than that. And the other banks aren’t any less “stupid”.
- array_key_first 11mo agoI mean, I concur, but ultimately I can't fix shitty banks being shitty. No geeks can. Banks have been shitty for a long, long time. Do you know how we usually stop them from being shitty? Forcefully, with legislation.
- buzer 11mo agoUnfortunately the EU regulation makes the truly user controlled 2FA methods essentially non-compliant. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32018R0389 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... > Article 7 Requirements of the elements categorised as possession > 1. Payment service providers shall adopt measures to mitigate the risk that the elements of strong customer authentication categorised as possession are used by unauthorised parties. > 2. The use by the payer of those elements shall be subject to measures designed to prevent replication of the elements.
- jojobas 11mo agoThis says something along the lines of "it should be hard to extract the TOTP secret". However if you can get so far as to get the secret from the TOTP app, you can as well back up the entire phone and restore elsewhere, can't you?
- nh2 11mo agoNo, because phones that lock keys in hardware effectively prevent that, and that works only with hardware that prevents its owners from having full control an doing what they want with their hardware. "Unextractable keys" works with hardware that you don't "truly own".
- potamic 11mo agoWhat if one doesn't own an android/iphone device? Banking is a fundamental need, so most countries regulate them to cater to a wide range of users. In this case it's possible that the bank could be compelled to provide you a 2FA device if you don't have one.
- distances 11mo agoI don't think there is such regulation. Many banks simply do not have any other means of authentication any more. They can't give out 2FA devices because their systems just don't support them.
- pjmlp 11mo agoGood luck with that, in Germany many public transport operators are moving into app based tickets for the monthly/yearly subscriptions. You can still get a plastic card, however it requires paying extra and some additional forms, the reasoning being it is not environment friendly.
- majirdulb 11mo agoDo they offer a physical 2FA device? Mine does and it's really useful