5 ms·

Which major banking and communications companies refuse to let you access their services via browser? This is when we absolutely need to name and shame.

jokethrowaway 5y ago
After the nth round of european regulations, plenty of banks started requiring a smartphone app installed on Android or iOS as 2 factor authentication
- josephcsible 5y ago
  What regulation requires Android or iOS in particular?
  - Findecanor 5y ago
    There is rather a lack of regulations that would require banks to provide two-factor authentication in a platform-neutral or technology-neutral manner. Instead of two-factor-only apps, we get "electronic ID" that are legally like a photo ID, and which are also used for making payments from the phone itself. In fact, some of these rely on security of the OS it is running on, and not on the use of any trusted platform modules ("secure enclave", TrustZone, etc.) or on any mathematical proof. Therefore, un-rooted recent versions of Android and iOS is compulsory in practice, because those are the only environments that are secure enough. And BTW, the electronic ID are very convenient for the banks. If they get social-engineered and the banks' API abused, the banks can conveniently blame the victims — because it's a legal ID and not merely a login helper or debit card, and you're not supposed to be "careless" with an ID.
    - Hackbraten 5y ago
      Some banks support dedicated devices for signing transactions if you don’t like to use a smartphone app for 2FA. I have two of those devices, a portable one and a USB-tethered one for the desktop. Either way, you insert your debit card to sign your transaction. The underlying protocol is a national standard (published by DK, the association of German banks) and meets all European requirements. I don’t do business with banks that require iOS or Android apps for 2FA unless they support an alternative.
  - fancyfredbot 5y ago
    Wrong question. It's the market which requires this, not the regulation.
  - MinorTom 5y ago
    Regulation requires 2-factor verification of sign-ins and transactions (and no, WebAuthn and TOTP aren't allowed). That leaves three options: * Physical hardware (what?) * SMS at 9 cent each * An app
    - josephcsible 5y ago
      > WebAuthn and TOTP aren't allowed Why not? If you say "security reasons", then why is SMS allowed, since it's way less secure? > SMS at 9 cent each What places still charge for SMS?
josephcsible 5y ago
Snapchat refuses to let you access their services at all via browser. And most banks offer you a restricted set of functionality via browser, e.g., no taking pictures of checks to deposit (in fact, I can't think of any banks that do let you do that via browser).
- solenoidalslide 5y ago
  What a wonderfully ripe area for disruption.
  - criddell 5y ago
    You're going to disrupt Snap by writing a more free version of it?
    - solenoidalslide 4y ago
      I didn't know they open sourced their code.
- fartcannon 5y ago
  You have to do the open source phone first, and help convince others, before the banks and snapchats will support you, not the other way around. It's normally a small sacrifice, but the payoff is fundamental to a free future.
  - josephcsible 5y ago
    You make it sound like the banks and Snapchat would have to do work for them to support me, when the opposite is true. The community already has compatibility layers that work for most apps, but those companies go out of their way to do extra work to make sure their apps don't work in them.
    - fartcannon 5y ago
      Yeah they're shitty. That's why maybe you shouldn't financially support ecosystems that you don't like just to use apps that are actively hostile to you. You don't need those things.
hef19898 5y ago
Postbank in Germany, and most other banks, require an app to sign in into their we services and approve money transfers and stuff like that. And Postbank requires, at the very least, microG (well, they did some time ago when I switched from Android to CalyxOS and tried to live without microG...). And yes, this sucks.

jokethrowaway 5y ago

After the nth round of european regulations, plenty of banks started requiring a smartphone app installed on Android or iOS as 2 factor authentication

josephcsible 5y ago
What regulation requires Android or iOS in particular?
- Findecanor 5y ago
  There is rather a lack of regulations that would require banks to provide two-factor authentication in a platform-neutral or technology-neutral manner. Instead of two-factor-only apps, we get "electronic ID" that are legally like a photo ID, and which are also used for making payments from the phone itself. In fact, some of these rely on security of the OS it is running on, and not on the use of any trusted platform modules ("secure enclave", TrustZone, etc.) or on any mathematical proof. Therefore, un-rooted recent versions of Android and iOS is compulsory in practice, because those are the only environments that are secure enough. And BTW, the electronic ID are very convenient for the banks. If they get social-engineered and the banks' API abused, the banks can conveniently blame the victims — because it's a legal ID and not merely a login helper or debit card, and you're not supposed to be "careless" with an ID.
  - Hackbraten 5y ago
    Some banks support dedicated devices for signing transactions if you don’t like to use a smartphone app for 2FA. I have two of those devices, a portable one and a USB-tethered one for the desktop. Either way, you insert your debit card to sign your transaction. The underlying protocol is a national standard (published by DK, the association of German banks) and meets all European requirements. I don’t do business with banks that require iOS or Android apps for 2FA unless they support an alternative.
- fancyfredbot 5y ago
  Wrong question. It's the market which requires this, not the regulation.
- MinorTom 5y ago
  Regulation requires 2-factor verification of sign-ins and transactions (and no, WebAuthn and TOTP aren't allowed). That leaves three options: * Physical hardware (what?) * SMS at 9 cent each * An app
  - josephcsible 5y ago
    > WebAuthn and TOTP aren't allowed Why not? If you say "security reasons", then why is SMS allowed, since it's way less secure? > SMS at 9 cent each What places still charge for SMS?

josephcsible 5y ago

Snapchat refuses to let you access their services at all via browser. And most banks offer you a restricted set of functionality via browser, e.g., no taking pictures of checks to deposit (in fact, I can't think of any banks that do let you do that via browser).

solenoidalslide 5y ago
What a wonderfully ripe area for disruption.
- criddell 5y ago
  You're going to disrupt Snap by writing a more free version of it?
  - solenoidalslide 4y ago
    I didn't know they open sourced their code.
fartcannon 5y ago
You have to do the open source phone first, and help convince others, before the banks and snapchats will support you, not the other way around. It's normally a small sacrifice, but the payoff is fundamental to a free future.
- josephcsible 5y ago
  You make it sound like the banks and Snapchat would have to do work for them to support me, when the opposite is true. The community already has compatibility layers that work for most apps, but those companies go out of their way to do extra work to make sure their apps don't work in them.
  - fartcannon 5y ago
    Yeah they're shitty. That's why maybe you shouldn't financially support ecosystems that you don't like just to use apps that are actively hostile to you. You don't need those things.

hef19898 5y ago

Postbank in Germany, and most other banks, require an app to sign in into their we services and approve money transfers and stuff like that. And Postbank requires, at the very least, microG (well, they did some time ago when I switched from Android to CalyxOS and tried to live without microG...). And yes, this sucks.