5 ms·

I think, practically, everyone will need at least a cheap-ish android or iphone, perhaps $300 (and a new one every few years ...), to be their locked-down "agen

by ploxiln 8mo ago

I think, practically, everyone will need at least a cheap-ish android or iphone, perhaps $300 (and a new one every few years ...), to be their locked-down "agent" for using financial or government services. It's not for you, it's for the government/banks, it is their agent for talking to you. Kinda weird, if you think about it. But that seems to be the way it's heading.

thisislife2 8mo ago
Or ... just don't install the apps and use the browser to do your banking.
- malux85 8mo ago
  Assuming the browser has feature parity. I was visiting my parents over Xmas and my dad couldn’t make a payment because the number of saved payees was capped to 100. There was literally no option to delete a payee in the website, the only way we found was to install the app, authenticate, and do it in there. It’s happening already.
  - thewebguyd 8mo ago
    I hate that this is happening. I absolutely detest doing any kind of task other than pure content consumption and basic messaging from a smart phone. Anything remotely more advanced than that, please let me use my computer and an app or website with, you know, an interface designed for more advanced operations. Trying to do anything on a smartphone/touchscreen only device is nothing but an effort in pure frustration for me.
- riedel 8mo ago
  Does not work anymore for many banks in Germany. I have 2 accounts that require me to have different second factor apps installed. For one bank I would have to open a separate account with a debit card to use hw tan generator. For the other AI would have to switch bank account after the regulators banned SMS and indexed paper TANs.
- andy99 8mo ago
  My (Canadian) bank extorted me into installing their app, literally blocking me from doing transfers of my own money without it - I had to install it and take a picture of myself and my ID. After this I was able to switch to sms authentication and delete it, but they’re obviously trying to force people onto the app, and eventually they will do so more aggressively. Of course in Canada we have a banking oligopoly that is effectively there just to rob people, but ironically any of the “challenger” startup banks are 100% app based afaik
  - FpUser 8mo ago
    May I ask what bank? I use CIBC and RBC. They do not require any apps on the phone to reach whatever services they offer. I use all my work on desktop. I did install app from CIBC for one single and the only purpose - deposit cheques sent to me by clients to my business account without having to go to ATM or the bank teller.
    - anothermoron 8mo ago
      [dead]
  - john01dav 8mo ago
    Perhaps you need a tech person to partner with experienced bank people to create a new bank that isn't shit
  - throwaway2037 8mo ago
    > Of course in Canada we have a banking oligopoly that is effectively there just to rob people Are there any OECD nations that don't have a banking oligopoly? I can think of at least one: Germany, because they have Sparkasse (community banks). Does Canada have community banks like Germany and the United States? If yes, then you should vote with your wallet and switch.
    - noir_lord 8mo ago
      UK has building societies, they function like a bank mostly but are mutual (owned by it's members). In my experience they are more pleasant to deal with, tend to be smaller/more conservative with tech and you can speak to a human when shit goes sideways. Mine has never laundered money for the cartels (unlike my other bank) which is a plus as well.
- deaux 8mo ago
  How are people on HN of all places still this short-sighted to not understand that this will stop being an option? It's incredible to see like 10 individuals commenting this all over threads like these. Think before you comment.
  - lfliosdjf 8mo ago
    Its already not an option in India with axis bank. Without mobile you can't do digital login.
lxgr 8mo ago
> everyone will need at least a cheap-ish android or iphone, perhaps $300 No, the much more secure while at the same time liberty-preserving way to do this are heavily sandboxed secure enclaves with attestation, or even better standalone tamper-proof devices capable of attestation. Like the ones practically every bank customer already has in their wallet, and for which most phones have a built-in reader these days... The only thing missing is a secure input and output channel, like a small built-in display and a button or biometric input. In any case, I somewhat empathize with banks in that they want to ensure that my transaction confirmation device is not compromised, but getting to dictate what software does and doesn't run on my own hardware outside of maybe a narrow sandbox needed to do that is a no-go.
- nine_k 8mo ago
  I don't see how a separate dedicated piece of hardware is less secure. It has zero contact whatsoever with your other comm devices. It can be switched off when not needed, to prevent any chance of tracking you. Think of it as of an advanced yubikey. It's not money-preserving though. You need an extra device, and an extra phone number. The separate phone number is another privacy-preserving feature though.
  - lxgr 8mo ago
    > Think of it as of an advanced yubikey. A cheap Android phone is pretty much the opposite of a Yubikey, in terms of trusted computing base and attack surface.
- roenxi 8mo ago
  In principle I'm certainly on board with the idea, but the problem is - at least in the Anglosphere, probably further - that the financial system is part of the military and policing systems. They are a powerful and persistent lobby that want a phone to be able to provide enough who-what-when-where to be able to put someone in jail or in extreme cases drop a missile on them. That is one of the reasons the crypto market is behaving like some radical innovation instead of just a group of bozos speedrunning financial history. For the first time since the invention of capital we have an asset class where it doesn't take the cooperation of a group of armed thugs to guarantee the integrity of the system.
lossolo 8mo ago
> perhaps $300 Maybe in US. In Vietnam, $300 is the average monthly salary, and the minimum wage is around $150. Probably the majority of people don't have a primary phone worth more than $300.
thewebguyd 8mo ago
Nah, if a bank or some other civic entity wants to have a "secure agent" for transactions/communication with me, then they should be the ones providing that. Much like I expect my employer to provide me hardware, and that hardware is used exclusively for work. I shouldn't have to spend my own money on another device, nor should they be asserting their desires for control onto my own devices.
- macbem 8mo ago
  And exactly who's going to pay for that?
  - thewebguyd 8mo ago
    The issuing entity. They want a "secure device" to do business with me, then they get to issue said device. Otherwise, they just get to be OK with offering me a website or letting me transact with them on my own device that's under my own control without stipulations like requiring attestation, or prohibiting root. The point is, governments nor banks or other private entities, should be getting to dictate what can and cannot be done on someone's computing device.
    - ncruces 8mo ago
      They're happy to provide that. It's a called debit card that you take to an ATM machine. It's been popular demand, not financial institutions, driving the change to “the smartphone can do everything, I don't want to take debit/credit cards with me everywhere.” People don't want an additional card, or yubi key, or printed second factor, or whatever, to authenticate. They want an app that uses a data connection, and a fingerprint to replace even needed a PIN. They tolerate a second channel: an SMS, if the app automatically reads it. That's as much inconvenience as the general public is willing to put up with. They're starting to demand that this works offline for smaller spends. And they'll put up with a phone call as a 3rd factor for when they want to unblock a really high spend, like purchasing a car, but it can't happen all the time. They want this to work reliably, even on holidays, all around the world. And they want the banks to cover losses if it all goes south. Now try to design a system that covers the requirements people are demanding for, without trusting the terminal the people decided they want to access it from.
shevy-java 8mo ago
This is ultimately a form of slavery though. A country that is a dictatorship - I can understand why their slaves have to go through this. I fail to see why a true democracy would do this though. There is zero need to be required to have a smartphone; all those transactions work perfectly fine on a desktop computer system too, under Linux. People then may have a second device at home, some card reader and/or a thing such as Yubiko or something like that. IMO not even this should be required, but to mandate an app that would not be permissive under Linux - that is true dictatorship. I am surprised the government of Vietnam went that way.
- nickff 8mo ago
  Even elected governments already have the ability to take whatever they want from you, and force you to act against your own interests; this seems like a comparatively minor infringement.
- esseph 8mo ago
  But with kernel level attestation, the banks can start requiring this on computers as well... (From the kernel-level anti-cheat discussion the other day)
gonzalohm 8mo ago
You can just use your bank's website. No need for two phones
- gcuvyvtvv6 8mo ago
  My bank turned their website off. Mobile app only now.
  - gonzalohm 8mo ago
    Really? And you are okay with losing access to your money if your phone is lost/stolen?
  - fhdkweig 8mo ago
    Care to name and shame that bank? I would like to avoid any bank that doesn't use a website.
- aembleton 8mo ago
  If your bank has a website.
  - fsflover 8mo ago
    If not, you should seriously consider switching banks (while you can). I suspect that such banks do not take security seriously: Giving control over your phone to Apple/Google is not security.
- skibidithink 8mo ago
  Until they decide that they only support 2FA by app push notification.
Dylan16807 8mo ago
I was going to object to $300, but maybe that will be needed if you want actual security... Just "a phone" with a bad update policy is $100.
regularfry 8mo ago
They can pay for it then. And I'll have my own, that I control.

by ploxiln 8mo ago

thisislife2 8mo ago

Or ... just don't install the apps and use the browser to do your banking.

malux85 8mo ago
Assuming the browser has feature parity. I was visiting my parents over Xmas and my dad couldn’t make a payment because the number of saved payees was capped to 100. There was literally no option to delete a payee in the website, the only way we found was to install the app, authenticate, and do it in there. It’s happening already.
- thewebguyd 8mo ago
  I hate that this is happening. I absolutely detest doing any kind of task other than pure content consumption and basic messaging from a smart phone. Anything remotely more advanced than that, please let me use my computer and an app or website with, you know, an interface designed for more advanced operations. Trying to do anything on a smartphone/touchscreen only device is nothing but an effort in pure frustration for me.
riedel 8mo ago
Does not work anymore for many banks in Germany. I have 2 accounts that require me to have different second factor apps installed. For one bank I would have to open a separate account with a debit card to use hw tan generator. For the other AI would have to switch bank account after the regulators banned SMS and indexed paper TANs.
andy99 8mo ago
My (Canadian) bank extorted me into installing their app, literally blocking me from doing transfers of my own money without it - I had to install it and take a picture of myself and my ID. After this I was able to switch to sms authentication and delete it, but they’re obviously trying to force people onto the app, and eventually they will do so more aggressively. Of course in Canada we have a banking oligopoly that is effectively there just to rob people, but ironically any of the “challenger” startup banks are 100% app based afaik
- FpUser 8mo ago
  May I ask what bank? I use CIBC and RBC. They do not require any apps on the phone to reach whatever services they offer. I use all my work on desktop. I did install app from CIBC for one single and the only purpose - deposit cheques sent to me by clients to my business account without having to go to ATM or the bank teller.
  - anothermoron 8mo ago
    [dead]
- john01dav 8mo ago
  Perhaps you need a tech person to partner with experienced bank people to create a new bank that isn't shit
- throwaway2037 8mo ago
  > Of course in Canada we have a banking oligopoly that is effectively there just to rob people Are there any OECD nations that don't have a banking oligopoly? I can think of at least one: Germany, because they have Sparkasse (community banks). Does Canada have community banks like Germany and the United States? If yes, then you should vote with your wallet and switch.
  - noir_lord 8mo ago
    UK has building societies, they function like a bank mostly but are mutual (owned by it's members). In my experience they are more pleasant to deal with, tend to be smaller/more conservative with tech and you can speak to a human when shit goes sideways. Mine has never laundered money for the cartels (unlike my other bank) which is a plus as well.
deaux 8mo ago
How are people on HN of all places still this short-sighted to not understand that this will stop being an option? It's incredible to see like 10 individuals commenting this all over threads like these. Think before you comment.
- lfliosdjf 8mo ago
  Its already not an option in India with axis bank. Without mobile you can't do digital login.

lxgr 8mo ago

> everyone will need at least a cheap-ish android or iphone, perhaps $300 No, the much more secure while at the same time liberty-preserving way to do this are heavily sandboxed secure enclaves with attestation, or even better standalone tamper-proof devices capable of attestation. Like the ones practically every bank customer already has in their wallet, and for which most phones have a built-in reader these days... The only thing missing is a secure input and output channel, like a small built-in display and a button or biometric input. In any case, I somewhat empathize with banks in that they want to ensure that my transaction confirmation device is not compromised, but getting to dictate what software does and doesn't run on my own hardware outside of maybe a narrow sandbox needed to do that is a no-go.

nine_k 8mo ago
I don't see how a separate dedicated piece of hardware is less secure. It has zero contact whatsoever with your other comm devices. It can be switched off when not needed, to prevent any chance of tracking you. Think of it as of an advanced yubikey. It's not money-preserving though. You need an extra device, and an extra phone number. The separate phone number is another privacy-preserving feature though.
- lxgr 8mo ago
  > Think of it as of an advanced yubikey. A cheap Android phone is pretty much the opposite of a Yubikey, in terms of trusted computing base and attack surface.
roenxi 8mo ago
In principle I'm certainly on board with the idea, but the problem is - at least in the Anglosphere, probably further - that the financial system is part of the military and policing systems. They are a powerful and persistent lobby that want a phone to be able to provide enough who-what-when-where to be able to put someone in jail or in extreme cases drop a missile on them. That is one of the reasons the crypto market is behaving like some radical innovation instead of just a group of bozos speedrunning financial history. For the first time since the invention of capital we have an asset class where it doesn't take the cooperation of a group of armed thugs to guarantee the integrity of the system.

lossolo 8mo ago

> perhaps $300 Maybe in US. In Vietnam, $300 is the average monthly salary, and the minimum wage is around $150. Probably the majority of people don't have a primary phone worth more than $300.

thewebguyd 8mo ago

Nah, if a bank or some other civic entity wants to have a "secure agent" for transactions/communication with me, then they should be the ones providing that. Much like I expect my employer to provide me hardware, and that hardware is used exclusively for work. I shouldn't have to spend my own money on another device, nor should they be asserting their desires for control onto my own devices.

macbem 8mo ago
And exactly who's going to pay for that?
- thewebguyd 8mo ago
  The issuing entity. They want a "secure device" to do business with me, then they get to issue said device. Otherwise, they just get to be OK with offering me a website or letting me transact with them on my own device that's under my own control without stipulations like requiring attestation, or prohibiting root. The point is, governments nor banks or other private entities, should be getting to dictate what can and cannot be done on someone's computing device.
  - ncruces 8mo ago
    They're happy to provide that. It's a called debit card that you take to an ATM machine. It's been popular demand, not financial institutions, driving the change to “the smartphone can do everything, I don't want to take debit/credit cards with me everywhere.” People don't want an additional card, or yubi key, or printed second factor, or whatever, to authenticate. They want an app that uses a data connection, and a fingerprint to replace even needed a PIN. They tolerate a second channel: an SMS, if the app automatically reads it. That's as much inconvenience as the general public is willing to put up with. They're starting to demand that this works offline for smaller spends. And they'll put up with a phone call as a 3rd factor for when they want to unblock a really high spend, like purchasing a car, but it can't happen all the time. They want this to work reliably, even on holidays, all around the world. And they want the banks to cover losses if it all goes south. Now try to design a system that covers the requirements people are demanding for, without trusting the terminal the people decided they want to access it from.

shevy-java 8mo ago

This is ultimately a form of slavery though. A country that is a dictatorship - I can understand why their slaves have to go through this. I fail to see why a true democracy would do this though. There is zero need to be required to have a smartphone; all those transactions work perfectly fine on a desktop computer system too, under Linux. People then may have a second device at home, some card reader and/or a thing such as Yubiko or something like that. IMO not even this should be required, but to mandate an app that would not be permissive under Linux - that is true dictatorship. I am surprised the government of Vietnam went that way.

nickff 8mo ago
Even elected governments already have the ability to take whatever they want from you, and force you to act against your own interests; this seems like a comparatively minor infringement.
esseph 8mo ago
But with kernel level attestation, the banks can start requiring this on computers as well... (From the kernel-level anti-cheat discussion the other day)

gonzalohm 8mo ago

You can just use your bank's website. No need for two phones

gcuvyvtvv6 8mo ago
My bank turned their website off. Mobile app only now.
- gonzalohm 8mo ago
  Really? And you are okay with losing access to your money if your phone is lost/stolen?
- fhdkweig 8mo ago
  Care to name and shame that bank? I would like to avoid any bank that doesn't use a website.
aembleton 8mo ago
If your bank has a website.
- fsflover 8mo ago
  If not, you should seriously consider switching banks (while you can). I suspect that such banks do not take security seriously: Giving control over your phone to Apple/Google is not security.
skibidithink 8mo ago
Until they decide that they only support 2FA by app push notification.

Dylan16807 8mo ago

I was going to object to $300, but maybe that will be needed if you want actual security... Just "a phone" with a bad update policy is $100.

regularfry 8mo ago

They can pay for it then. And I'll have my own, that I control.