3 ms·

After the nth round of european regulations, plenty of banks started requiring a smartphone app installed on Android or iOS as 2 factor authentication

josephcsible 5y ago
What regulation requires Android or iOS in particular?
- Findecanor 5y ago
  There is rather a lack of regulations that would require banks to provide two-factor authentication in a platform-neutral or technology-neutral manner. Instead of two-factor-only apps, we get "electronic ID" that are legally like a photo ID, and which are also used for making payments from the phone itself. In fact, some of these rely on security of the OS it is running on, and not on the use of any trusted platform modules ("secure enclave", TrustZone, etc.) or on any mathematical proof. Therefore, un-rooted recent versions of Android and iOS is compulsory in practice, because those are the only environments that are secure enough. And BTW, the electronic ID are very convenient for the banks. If they get social-engineered and the banks' API abused, the banks can conveniently blame the victims — because it's a legal ID and not merely a login helper or debit card, and you're not supposed to be "careless" with an ID.
  - Hackbraten 5y ago
    Some banks support dedicated devices for signing transactions if you don’t like to use a smartphone app for 2FA. I have two of those devices, a portable one and a USB-tethered one for the desktop. Either way, you insert your debit card to sign your transaction. The underlying protocol is a national standard (published by DK, the association of German banks) and meets all European requirements. I don’t do business with banks that require iOS or Android apps for 2FA unless they support an alternative.
- fancyfredbot 5y ago
  Wrong question. It's the market which requires this, not the regulation.
- MinorTom 5y ago
  Regulation requires 2-factor verification of sign-ins and transactions (and no, WebAuthn and TOTP aren't allowed). That leaves three options: * Physical hardware (what?) * SMS at 9 cent each * An app
  - josephcsible 5y ago
    > WebAuthn and TOTP aren't allowed Why not? If you say "security reasons", then why is SMS allowed, since it's way less secure? > SMS at 9 cent each What places still charge for SMS?

josephcsible 5y ago

What regulation requires Android or iOS in particular?

Findecanor 5y ago
There is rather a lack of regulations that would require banks to provide two-factor authentication in a platform-neutral or technology-neutral manner. Instead of two-factor-only apps, we get "electronic ID" that are legally like a photo ID, and which are also used for making payments from the phone itself. In fact, some of these rely on security of the OS it is running on, and not on the use of any trusted platform modules ("secure enclave", TrustZone, etc.) or on any mathematical proof. Therefore, un-rooted recent versions of Android and iOS is compulsory in practice, because those are the only environments that are secure enough. And BTW, the electronic ID are very convenient for the banks. If they get social-engineered and the banks' API abused, the banks can conveniently blame the victims — because it's a legal ID and not merely a login helper or debit card, and you're not supposed to be "careless" with an ID.
- Hackbraten 5y ago
  Some banks support dedicated devices for signing transactions if you don’t like to use a smartphone app for 2FA. I have two of those devices, a portable one and a USB-tethered one for the desktop. Either way, you insert your debit card to sign your transaction. The underlying protocol is a national standard (published by DK, the association of German banks) and meets all European requirements. I don’t do business with banks that require iOS or Android apps for 2FA unless they support an alternative.
fancyfredbot 5y ago
Wrong question. It's the market which requires this, not the regulation.
MinorTom 5y ago
Regulation requires 2-factor verification of sign-ins and transactions (and no, WebAuthn and TOTP aren't allowed). That leaves three options: * Physical hardware (what?) * SMS at 9 cent each * An app
- josephcsible 5y ago
  > WebAuthn and TOTP aren't allowed Why not? If you say "security reasons", then why is SMS allowed, since it's way less secure? > SMS at 9 cent each What places still charge for SMS?