My bank used to do the tokens until some mathematician reverse engineered the algorithm proving it insecure. They've now moved on to certificates on your phone

My bank used to do the tokens until some mathematician reverse engineered the algorithm proving it insecure. They've now moved on to certificates on your phone. You go to the bank, prove your identity, they sms you a certificate. When you choose electronic authentication on the website you get a popup on your phone to accept. You put in a password and it validates the cert on your phone and sends the response to the website. All without having to install anything.