5 ms·

Most online banking sites in Germany require a phone nowadays, some even one that passes Google safety net for Android phones.

timakro 5y ago
Some banks in Germany support chipTAN which doesn't require a phone. You can find a list of banks supporting chipTAN here: https://www.kostenloser-girokonto-vergleich.de/diese-banken-bieten-hbci-oder-chiptan-mit-tan-generator-an/ https://www.kostenloser-girokonto-vergleich.de/diese-banken-...
- deleted 5y ago
  [deleted]
- Semaphor 5y ago
  That list is outdated. I was doubtful DKB (which you can’t even use with rooted Android devices, I had to cancel my account via customer support because they decided to cut me off with a minor update) allows chipTAN, and the latest comment is that they stopped supporting it.
  - dvdkhlng 5y ago
    I'm regularly using chipTAN with a stand-alone TAN generator (similar to [1], based on optical flicker-code) for a DKB account. No problems so far. Deutsche bank uses PhotoTAN, which supports hardware TAN generators [2]. Some banks use different but similar TAN generators (e.g. SecurePlus [3]), and I also witnessed Postbank accounts operated with USB-based TAN generators [4] called "BestSign". [1] https://www.voelkner.de/products/476429/REINER-SCT-tanJack-optic-CX-TAN-Generator.html?offer=00fccd0e63f9b64402340a52708601e4 https://www.voelkner.de/products/476429/REINER-SCT-tanJack-o... [2] https://genostore.de/db/phototan-lesegeraet/92/phototan-lesegeraet-digipass-760-deutsche-bank https://genostore.de/db/phototan-lesegeraet/92/phototan-lese... [3] https://cb.kobilshop.com/secureplus-generator/1/secureplus-generator https://cb.kobilshop.com/secureplus-generator/1/secureplus-g... securePlus Generator [4] https://www.seal-one.com/devices.en#DiVc3100KLink https://www.seal-one.com/devices.en#DiVc3100KLink BestSign
    - Semaphor 5y ago
      You are right and I stand corrected
dvdkhlng 5y ago
AFAICS, no, they don't. If you don't install the bank's app, you are usually offered to use a stand-alone hardware TAN generator. I currently have 4 TAN generators for different bank accounts (because everybody seeems to use a different protocol). On the positive side, a stand-alone air-gapped TAN generator feels much saver than using a (possibly back-doored) smart-phone to do on-line banking.
- 4ad 5y ago
  Obviously I can't speak for every country and every bank, but at least in two countries and with two banks they are trying really hard to get me off the hardware tokens and onto mobile phones. They have done all kinds of dark patterns, for example they update the website (which eventually becomes a mandatory update), but that requires relinquishing the hardware token, or they update their mobile app, and if you even try to log-in into the new app they automatically cancel your token, etc. When my token's battery died, they didn't want to give me a new one. They said they don't offer the service anymore. Only after escalating N times and explaining that I need a hardware token because their SMS-based 2FA didn't work internationally they gave me a new token. Suddenly it wasn't discontinued anymore. Now they moved off SMS-based 2FA to some mobile app, so I suspect next time I need a token I won't be able to get it. Make no mistake, enjoy your TAN generator while you can, because you will not be able to enjoy it for long. In the country I live in right now, the only way to get a proof for your COVID-19 vaccination is if you "voluntarily" enroll into some phone-based authentication scheme with your government that requires a modern, non-jailbroken iOS or Android device.
  - dvdkhlng 5y ago
    In germany (and I'd assume standardized throughout europe) COVID vaccination digital certificate is just that: a digitally signed certificate (encoding your name+vaccination meta-info) passed around via QR code. While you can use an App to read and present it, just having a paper-copy of the QR code (plus some ID document proving that the name on the certificate matches your person) should be enough to prove your vaccination status.
    - 5y ago
phatfish 5y ago
You mean a phone to receive a text for MFA? "Most" can't be more than that. However there are a couple of new "Fintech" banks in the UK that are mobile app only. No website and I assume very difficult to get anyone on the phone. That seems crazy to me. Access to your bank is at the mercy of Google/Apple.
- Aerroon 5y ago
  They probably require something like SmartID, which means that you need to have a smartphone that's not rooted. Ie can't even use LineageOS.
  - Semaphor 5y ago
    Rooted is unrelated, some apps require it, others don’t. But several require their proprietary app to access the online banking website from your computer.
    - hfsh 5y ago
      Rooted is related in that some apps will refuse to work, or will disable features if they detect that the phone is rooted.
      - fragileone 5y ago
        Until SafetyNet is improved you can still hide you're rooted via MagiskHide.
      - Semaphor 5y ago
        I wrote that, yes. But my comment was about the broader situation and not just about the apps requiring root.
josefx 5y ago
Mine has it as an option, but it also supports this[1] external tan generator. I use it since I do not understand how a single device that could hold all the data needed for online banking can be considered 2 factor, when its 1 factor at best. [1]https://www.mediamarkt.de/de/product/_reinersct-tanjack%C2%AE-optic-sr-1958097.html https://www.mediamarkt.de/de/product/_reinersct-tanjack%C2%A...

timakro 5y ago

Some banks in Germany support chipTAN which doesn't require a phone. You can find a list of banks supporting chipTAN here: https://www.kostenloser-girokonto-vergleich.de/diese-banken-bieten-hbci-oder-chiptan-mit-tan-generator-an/ https://www.kostenloser-girokonto-vergleich.de/diese-banken-...

deleted 5y ago
[deleted]
Semaphor 5y ago
That list is outdated. I was doubtful DKB (which you can’t even use with rooted Android devices, I had to cancel my account via customer support because they decided to cut me off with a minor update) allows chipTAN, and the latest comment is that they stopped supporting it.
- dvdkhlng 5y ago
  I'm regularly using chipTAN with a stand-alone TAN generator (similar to [1], based on optical flicker-code) for a DKB account. No problems so far. Deutsche bank uses PhotoTAN, which supports hardware TAN generators [2]. Some banks use different but similar TAN generators (e.g. SecurePlus [3]), and I also witnessed Postbank accounts operated with USB-based TAN generators [4] called "BestSign". [1] https://www.voelkner.de/products/476429/REINER-SCT-tanJack-optic-CX-TAN-Generator.html?offer=00fccd0e63f9b64402340a52708601e4 https://www.voelkner.de/products/476429/REINER-SCT-tanJack-o... [2] https://genostore.de/db/phototan-lesegeraet/92/phototan-lesegeraet-digipass-760-deutsche-bank https://genostore.de/db/phototan-lesegeraet/92/phototan-lese... [3] https://cb.kobilshop.com/secureplus-generator/1/secureplus-generator https://cb.kobilshop.com/secureplus-generator/1/secureplus-g... securePlus Generator [4] https://www.seal-one.com/devices.en#DiVc3100KLink https://www.seal-one.com/devices.en#DiVc3100KLink BestSign
  - Semaphor 5y ago
    You are right and I stand corrected

dvdkhlng 5y ago

AFAICS, no, they don't. If you don't install the bank's app, you are usually offered to use a stand-alone hardware TAN generator. I currently have 4 TAN generators for different bank accounts (because everybody seeems to use a different protocol). On the positive side, a stand-alone air-gapped TAN generator feels much saver than using a (possibly back-doored) smart-phone to do on-line banking.

4ad 5y ago
Obviously I can't speak for every country and every bank, but at least in two countries and with two banks they are trying really hard to get me off the hardware tokens and onto mobile phones. They have done all kinds of dark patterns, for example they update the website (which eventually becomes a mandatory update), but that requires relinquishing the hardware token, or they update their mobile app, and if you even try to log-in into the new app they automatically cancel your token, etc. When my token's battery died, they didn't want to give me a new one. They said they don't offer the service anymore. Only after escalating N times and explaining that I need a hardware token because their SMS-based 2FA didn't work internationally they gave me a new token. Suddenly it wasn't discontinued anymore. Now they moved off SMS-based 2FA to some mobile app, so I suspect next time I need a token I won't be able to get it. Make no mistake, enjoy your TAN generator while you can, because you will not be able to enjoy it for long. In the country I live in right now, the only way to get a proof for your COVID-19 vaccination is if you "voluntarily" enroll into some phone-based authentication scheme with your government that requires a modern, non-jailbroken iOS or Android device.
- dvdkhlng 5y ago
  In germany (and I'd assume standardized throughout europe) COVID vaccination digital certificate is just that: a digitally signed certificate (encoding your name+vaccination meta-info) passed around via QR code. While you can use an App to read and present it, just having a paper-copy of the QR code (plus some ID document proving that the name on the certificate matches your person) should be enough to prove your vaccination status.
  - 5y ago

phatfish 5y ago

You mean a phone to receive a text for MFA? "Most" can't be more than that. However there are a couple of new "Fintech" banks in the UK that are mobile app only. No website and I assume very difficult to get anyone on the phone. That seems crazy to me. Access to your bank is at the mercy of Google/Apple.

Aerroon 5y ago
They probably require something like SmartID, which means that you need to have a smartphone that's not rooted. Ie can't even use LineageOS.
- Semaphor 5y ago
  Rooted is unrelated, some apps require it, others don’t. But several require their proprietary app to access the online banking website from your computer.
  - hfsh 5y ago
    Rooted is related in that some apps will refuse to work, or will disable features if they detect that the phone is rooted.
    - fragileone 5y ago
      Until SafetyNet is improved you can still hide you're rooted via MagiskHide.
    - Semaphor 5y ago
      I wrote that, yes. But my comment was about the broader situation and not just about the apps requiring root.

josefx 5y ago

Mine has it as an option, but it also supports this[1] external tan generator. I use it since I do not understand how a single device that could hold all the data needed for online banking can be considered 2 factor, when its 1 factor at best. [1]https://www.mediamarkt.de/de/product/_reinersct-tanjack%C2%AE-optic-sr-1958097.html https://www.mediamarkt.de/de/product/_reinersct-tanjack%C2%A...