4 ms·
Should be optional. I feel equally threatened by a potentially weak bank app running on my phone all the time as I would my carrier giving away the keys to the
by 177tcca 6y ago
Should be optional.
I feel equally threatened by a potentially weak bank app running on my phone all the time as I would my carrier giving away the keys to the castle.
- boring_twenties 6y agoIf only there were any perfectly good open standards for 2FA that were implemented by numerous free apps and/or secure hardware tokens...
- account42 6y agoTOTP is not good enough for banking where you really want to confirm specific transactions, not generate codes that an active attacker intercepting your session could use to do anything.
- boring_twenties 6y agoFair point, but if one declines to install their proprietary apps it just falls back to SMS verification which is obviously terrible. Kraken (a cryptocurrency exchange) allows you to set up one TOTP token for regular logins, and another, separate one for withdrawals... obviously not as good as individual confirmations but still a heck of a lot better than SMS!
- stonogo 6y agoIt is optional. I'm a USAA customer as well, here's a screenshot from thirty seconds ago: https://i.imgur.com/boA4dc1.png https://i.imgur.com/boA4dc1.png