3 ms·

What really grinds my gears is the seemingly unstoppable global transition towards SMS to a mobile phone number as means of identifying an individual, conflated

by 3np 5y ago

What really grinds my gears is the seemingly unstoppable global transition towards SMS to a mobile phone number as means of identifying an individual, conflated with "security" through 2FA/account recovery, with this as the only option. This is especially popular within Fintech. Wise (formerly Transferwise) recently started requiring 2FA for signing in - SMS is the one and only option. Revolut requires it for acknowledging transactions and changing/viewing debit card info. That legacy banks do this is expected, but I'm really concerned about this trend among newer global and big actors who otherwise present themselves as modern. I strongly urge other users here to reach out to customer support of these companies and request them to supplement this with some other more secure means of 2FA, such as TOTP (hey, we gotta take what we can get), U2F, or Webauthn.

FabHK 5y ago
Super annoying, especially when (prior to the pandemic) I traveled a lot and had a new SIM every month or two. Insanity.
potatoz2 5y ago
Wise supports 2FA through their app (similar to what Google does, with a prompt).
oezi 5y ago
Well, the European PSD2 has forbidden the use of SMS TANs last year for banking applications while requiring much more stringent 2FA use (for account balances more than 30 days in the past for instance). So, I would say quite the opposite to unstoppable.
- cromka 5y ago
  Yep, and the banks are literally reaching the deadline as we speak. All my EU banks are notifying me that within a week or so the SMS codes will stop working, and their mobile app will be required for 2FA.
- tgsovlerkhgsel 5y ago
  And because it has not required some open standard as a replacement, I now have hundreds of MB of different bloatware bank apps on my phone, each of which I have to use in a slightly different way when logging into my bank accounts, usually with scanning barcodes or remembering yet another PIN. Migrating to a new phone is a nightmare. For extra convenience, PSD2 also mandated a logout after 5 minutes of inactivity. Some of the ideas behind PSD2 are great, but the outcome is about as good as the cookie directive.
  - oezi 5y ago
    Absolutely agreed. I expect consolidation to happen in the next couple of years on this. Banks who do it well, will win customers.
    - tgsovlerkhgsel 5y ago
      I've only seen it get worse, and I don't expect that to change. One of my apps where I spend money on a regular basis (always similar small amounts, always from the same phone, usually from the same IP) constantly triggers 2FA via my banking app. Even as an informed customer, I have no idea whether to blame that app, their payment gateway, Visa/Mastercard, or my bank (that issued the credit card) for that bullshit. The previous situation (banks absorb the fraud) seemed much better for me as the customer, and banks stuck with it. PSD2 made it so that customers can't pick their bank based on which is more convenient, by making them all at least roughly equally inconvenient. Few people will bother to change banks over this, and even fewer banks will feel enough pressure to actually improve.

by 3np 5y ago

FabHK 5y ago

Super annoying, especially when (prior to the pandemic) I traveled a lot and had a new SIM every month or two. Insanity.

potatoz2 5y ago

Wise supports 2FA through their app (similar to what Google does, with a prompt).

oezi 5y ago

Well, the European PSD2 has forbidden the use of SMS TANs last year for banking applications while requiring much more stringent 2FA use (for account balances more than 30 days in the past for instance). So, I would say quite the opposite to unstoppable.

cromka 5y ago
Yep, and the banks are literally reaching the deadline as we speak. All my EU banks are notifying me that within a week or so the SMS codes will stop working, and their mobile app will be required for 2FA.
tgsovlerkhgsel 5y ago
And because it has not required some open standard as a replacement, I now have hundreds of MB of different bloatware bank apps on my phone, each of which I have to use in a slightly different way when logging into my bank accounts, usually with scanning barcodes or remembering yet another PIN. Migrating to a new phone is a nightmare. For extra convenience, PSD2 also mandated a logout after 5 minutes of inactivity. Some of the ideas behind PSD2 are great, but the outcome is about as good as the cookie directive.
- oezi 5y ago
  Absolutely agreed. I expect consolidation to happen in the next couple of years on this. Banks who do it well, will win customers.
  - tgsovlerkhgsel 5y ago
    I've only seen it get worse, and I don't expect that to change. One of my apps where I spend money on a regular basis (always similar small amounts, always from the same phone, usually from the same IP) constantly triggers 2FA via my banking app. Even as an informed customer, I have no idea whether to blame that app, their payment gateway, Visa/Mastercard, or my bank (that issued the credit card) for that bullshit. The previous situation (banks absorb the fraud) seemed much better for me as the customer, and banks stuck with it. PSD2 made it so that customers can't pick their bank based on which is more convenient, by making them all at least roughly equally inconvenient. Few people will bother to change banks over this, and even fewer banks will feel enough pressure to actually improve.