Remix.run Logo
TFNA an hour ago

In many countries, all major local banks require their phone app as the second factor to log in to the browser version of their online banking. Sometimes functionality is removed from the browser version and made available only in the phone app.

drnick1 an hour ago | parent | next [-]

"Many" is doing a lot of work here. A more accurate statement would be that some banks in some countries require invasive apps, but fortunately it isn't the case everywhere (yet).

renehsz 2 minutes ago | parent [-]

This is a huge problem in EU countries!

The relevant regulations are Commission Delegated Regulation (EU) 2018/389 and the earlier Directive (EU) 2015/2366.

While these laws are deliberately vague when it comes to specific technologies, they do require at least two independent factors from different categories, such as knowledge (password) and possession (phone).

That, in and of itself, wouldn't be a problem. The way most banks implement it, however, is by giving you two choices:

1. You use their mobile app (which likely requires device attestation and Google Play Services, so won't work on a plain LineageOS install)

2. You use their CardTAN device, which is extremely inconvenient to always carry around.

Sure, we nerds might argue they should just let us use our Yubikeys or regular old TOTP, but pretty much no bank implements that. (Why? Your guess is as good as mine.)

Personally, I had to buy a second stock Samsung phone just for banking apps. And yes, there are still alternatives (only very very few though), but no, none of them are convenient, for various unrelated reasons.

I wouldn't be surprised if this continues to spread to the US too, under the sneaky disguise of "security".

dotancohen an hour ago | parent | prev | next [-]

And what do people without a smartphone use?

renehsz 30 minutes ago | parent [-]

A hardware-based CardTAN device, which is super inconvenient. Or else they can't do any online banking at all.

crying in EU :(

DANmode an hour ago | parent | prev [-]

Name five.

catlikesshrimp an hour ago | parent [-]

BAC in Central Americal https://www.baccredomatic.com