6 ms·

For a lot of time I've been trying to find e.g. a bank that would not basically require an Android or iOS device for me to shop online. Many of them even have "

For a lot of time I've been trying to find e.g. a bank that would not basically require an Android or iOS device for me to shop online. Many of them even have "root detectors" which basically means these programs won't work in "rooted", "de-Googlefied" and/or free Android implementations. After some complains the only thing I managed to get is for them to fallback to SMS 2FA which at this point I consider a blessing. I've already said this numerous times here on HN, but it is a dark future we are getting into. The only thing that came remotely close to this level of "you require this proprietary software for daily life" level of danger was ActiveX.

xyzzy_plugh 4y ago
You're not wrong, but it's real problem, both technically and socially, without much in the way of a good solution. Android and iOS provide significant security by virtue of the chain of trust running starting with Google or Apple down through their software and hardware (Google is a bit special here, I'll admit). This makes it easy for businesses like banks to work with those ecosystems and provide a secure experience without inventing much themselves. What's the alternative? SMS 2FA is abysmal. Maybe they could provide you a configurable webhook, but now they don't control the experience, and that's part of their requirements. Not to mention I wouldn't trust a bank to implement webhooks correctly. The problem is we're becoming sophisticated enough as a society that we are forced to rely on a few establishments to maintain that sophistication. Whether it's for chain of security, microprocessors, springs in our toasters, it's not possible to keep everything open and interchangeable while maintaining our current way of life. I'd love that, but it's not realistic, as far as I can tell.
- shkkmo 4y ago
  > What's the alternative? SMS 2FA is abysmal. There are cross platform MFA solutions that could be supported. Your guess is as good as mine as to why banks don't support them.
- Wowfunhappy 4y ago
  > SMS 2FA is abysmal Is there actually anything wrong with SMS 2FA, other than SIM swapping? SIM swapping isn't a problem with SMS so much as the phone carriers, who really need to put stricter processes in place for verifying account transfers. IMO, they deserve most of the culpability.
  - Thlom 4y ago
    In Scandinavia we have BankID which kind of uses SMS, but not quite. When I try to authenticate it sends a message to my phone and then I have to type in my 4-8 digit pin code on my phone. Apparently they have put a tiny application on the sim card, so sim swapping isn't an issue. Whenever I get a new sim card I have to authenticate the sim card using my hardware token and password.
    - Ekaros 4y ago
      Finland I got sometimes SMS in flow. For bank login it is account and password, then one time code. Then when making transaction getting SMS with which one time code to enter. And then when paying with confirmation same thing but just with SMS code. I don't really see point of SMS in flow, but hey I can somewhat live with it.
  - justsomehnguy 4y ago
    Have only a small amount of money on you regular account for the everyday means, with all the money on another account whatever. Lose your wallet with cards, lose your phone (or just a phone with Apple/GooglePay). Get a replacement SIM, be locked out of receiving any SMS for 24h[0]. Now be somewhere where is no local branches of your bank.[1] Or even better - be abroad. Or just be in a taxi at 9PM when no one works and the bank locks you out - just like when it happened to me. Gladly I found an ATM where I could withdraw from a secondary account. [0] Actual practice of cellular operators in my country. Safety [1] Even better with the virtual banks without any.
    - Wowfunhappy 4y ago
      Isn’t this a problem with _any_ type of 2FA? I agree insofar as, this is exactly why I strongly believe that 2FA should always be optional. But, if the user has chosen to use 2FA (or has not opted out), what’s wrong with SMS?
- AshamedCaptain 4y ago
  Before the "standardization" on SMS first and later on Google/Apple systems, there were a number of methods, since banks did try to do R&D to cut out on fraud: * One-time-pads (yes, I had a bank that would give me a card with 50 codes you were supposed to use once, then go back to the branch for more. Didn't last long, though, and was replaced with:) * Reusable codes: bank gives you a card with 50 codes. Bank randomly asks you for code number X. X may eventually repeat over time. (Bank also tells you your specific card serial number so that you can identify them). * Credit cards housing an actual e-Ink display that would give TOTP codes. https://www.e-ink-info.com/e-ink-used-create-dynamic-cvv-credit-cards https://www.e-ink-info.com/e-ink-used-create-dynamic-cvv-cre... * Actual FIDO devices.
  - aenis 4y ago
    My bank issues a fido device: a card scanner with a built in camera that reads qr codes. Excellent tool, but for a few years now the bank is actively discouraging its use, touting the benefits of apps instead. It costs them around 60 euro to issue the device, and, sadly, thats incentive enough to advocate less secure solutions. When they take it away from me, I am out of options as this is the last bank in my country that issues them to individuals :-/
    - teekert 4y ago
      Rabobank? Yes it’s nice but I always find it a pain haha. 60€ wow, when they were first send around they very easily gave me 2 extra to put at work etc. What about N26, I don’t remember needing the app and I can log into a website. Not sure though…
- cm2187 4y ago
  Not really a technical challenge. You could force an equivalent of POSIX, maybe based on WASM, that smartphone makers would be forced to support if they want to sell in your region, and forced to support side loading those apps, as no government should be subject to the caprices of the various app stores. At this point smartphones have a fairly mature feature set to expose to the app. That would also help with the anti-competitive app store practices.
- rsync 4y ago
  "What's the alternative? SMS 2FA is abysmal." It seems to be forgotten that email 2FA exists. I can't quantify the risks relative to SMS 2FA because there are such broad ranging implementations but given the broad adoption of gmail, how many people can really snoop unencrypted email traffic at backbone chokepoints ? There are many cases where I would be perfectly happy with the risk profile of either SIM swap attacks or email interception.
  - daveoc64 4y ago
    The main problem with email 2FA is that if someone gains access to your email account, they can reset your passwords on many sites and services. They can then bypass both the password (by resetting it) and the 2FA (by simply reading your emails). Even better, if you re-use passwords, they can use one password to access your email account and the service, and get the 2FA token via email.
    - wlecometo 4y ago
      if someone gets access to your phone they can do way more damage, but this is accepted.
  - jamal-kumar 4y ago
    It's a lot easier to compromise an enormous purchased batch of email addresses than it is to do SIM swapping attacks on that scale
- mateo1 4y ago
  One thing that can and must be fixed instantly is to legislate that these businesses can not deny their services to anyone, just like systemic banks and the post office.
- polskibus 4y ago
  Why is SMS 2FA abysmal?
  - formerkrogemp 4y ago
    Can't your number be spoofed?
- amelius 4y ago
  > The problem is we're becoming sophisticated enough as a society that we are forced to rely on a few establishments to maintain that sophistication. Come on, we have open webbrowsers, which are 100x more difficult to implement than a chain of trust. Surely, somebody could come up with a reliable alternative.
layer8 4y ago
Maybe there’s a market for dual-OS-installation smartphones, as an extension of dual-SIM ones.
floren 4y ago
Can't you just use a credit card? Every time any HN discussion veers toward alternative smartphone OSes, for instance, people come out of the woodwork to talk about how they just couldn't possibly access their bank without an Android or iOS device... what are you all doing with your bank so often? I log in a couple times a month, from my PC, to check balances and pay my car loan. I've certainly never needed a damn app.
- AshamedCaptain 4y ago
  Most banks in the EU require 2FA _every time_ you use a credit card online, due to a EU directive: https://en.wikipedia.org/wiki/Strong_customer_authentication https://en.wikipedia.org/wiki/Strong_customer_authentication
  - heavenlyblue 4y ago
    Yeah. My TSB bank recently implemented this: - enter credit card details on the website - got to the mobile app, enter second password - receive an SMS to my phone number with 2fa code - login into the app, approve the payment - enter first account password - go back to the website and click continue That’a all together with iOS FaceID enabler. Monzo is actually way simpler.
  - Symbiote 4y ago
    I've started using MobilePay — the Danish send-money-to-anyone-with-a-phone-number system — rather than a debit/credit card wherever it's offered. I've usually provided my phone number already, as part of the delivery address, so it's a click to choose MobilePay, another to confirm the number, then I fingerprint-unlock the MobilePay app and swipe to confirm the payment request that appears.
    - rvense 4y ago
      It's not really "send-money-to-anyone-with-a-phone-number", it's "send-money-to-anyone-with-the-mobilepay-app-installed" - and it only works on iPhones and unrooted Android phones with Google services enabled. As someone who doesn't have it, it's very rapidly become the thing that makes me feel the most like a second-class citizen.
mFixman 4y ago
In case you are still looking for a card that will work without an app, American Express sends you emails and SMSs with validation codes for online purchases.
jeroenhd 4y ago
My bank doesn't seem to do root detection. I haven't tried it on a phone without at least microgapps but I'm pretty sure that it just works. Even on LineageOS with root I never really had any problems. I do recall seeing a popup at one point ("hey we see you've done some weird shit to your phone, call us if you don't knowewhat rooting means" or something like that) but that's really just about it. I should try running it in Anbox, come to think of it. Would be a fun experience. If you're a developer in the EU and you think you can do better, the PSD2 system is set up to allow for fintech solutions like these. You'll need to get the necessary documentation in order, or even a license, to get access to actual banking APIs (thank goodness) but from that point on you should be able to write your own app. You'll have to be very careful, though, you don't want to anger the financial regulators.
- rainmaking 4y ago
  Which bank is that? My bank sees weird shit on my phone, it shuts down with no error message. I want in.
  - jeroenhd 4y ago
    Your mileage may vary, but https://ing.nl/ https://ing.nl/ has been working great for me. Probably not as good outside the Netherlands. https://https://play.google.com/store/apps/details?id=com.ing.mobile&hl=nl&gl=US https://https://play.google.com/store/apps/details?id=com.in... Also, I tried running the app in Anbox but there's no x86 build of the APK and Google's ARM Android emulator is just broken these days, the VM doesn't even boot.
    - ThePowerOfFuet 4y ago
      Bunq's app works great on GrapheneOS without any Google services installed whatsoever.
ThePowerOfFuet 4y ago
FWIW, Bunq's app works on GrapheneOS without any Google services installed whatsoever.

xyzzy_plugh 4y ago

You're not wrong, but it's real problem, both technically and socially, without much in the way of a good solution. Android and iOS provide significant security by virtue of the chain of trust running starting with Google or Apple down through their software and hardware (Google is a bit special here, I'll admit). This makes it easy for businesses like banks to work with those ecosystems and provide a secure experience without inventing much themselves. What's the alternative? SMS 2FA is abysmal. Maybe they could provide you a configurable webhook, but now they don't control the experience, and that's part of their requirements. Not to mention I wouldn't trust a bank to implement webhooks correctly. The problem is we're becoming sophisticated enough as a society that we are forced to rely on a few establishments to maintain that sophistication. Whether it's for chain of security, microprocessors, springs in our toasters, it's not possible to keep everything open and interchangeable while maintaining our current way of life. I'd love that, but it's not realistic, as far as I can tell.

shkkmo 4y ago
> What's the alternative? SMS 2FA is abysmal. There are cross platform MFA solutions that could be supported. Your guess is as good as mine as to why banks don't support them.
Wowfunhappy 4y ago
> SMS 2FA is abysmal Is there actually anything wrong with SMS 2FA, other than SIM swapping? SIM swapping isn't a problem with SMS so much as the phone carriers, who really need to put stricter processes in place for verifying account transfers. IMO, they deserve most of the culpability.
- Thlom 4y ago
  In Scandinavia we have BankID which kind of uses SMS, but not quite. When I try to authenticate it sends a message to my phone and then I have to type in my 4-8 digit pin code on my phone. Apparently they have put a tiny application on the sim card, so sim swapping isn't an issue. Whenever I get a new sim card I have to authenticate the sim card using my hardware token and password.
  - Ekaros 4y ago
    Finland I got sometimes SMS in flow. For bank login it is account and password, then one time code. Then when making transaction getting SMS with which one time code to enter. And then when paying with confirmation same thing but just with SMS code. I don't really see point of SMS in flow, but hey I can somewhat live with it.
- justsomehnguy 4y ago
  Have only a small amount of money on you regular account for the everyday means, with all the money on another account whatever. Lose your wallet with cards, lose your phone (or just a phone with Apple/GooglePay). Get a replacement SIM, be locked out of receiving any SMS for 24h[0]. Now be somewhere where is no local branches of your bank.[1] Or even better - be abroad. Or just be in a taxi at 9PM when no one works and the bank locks you out - just like when it happened to me. Gladly I found an ATM where I could withdraw from a secondary account. [0] Actual practice of cellular operators in my country. Safety [1] Even better with the virtual banks without any.
  - Wowfunhappy 4y ago
    Isn’t this a problem with _any_ type of 2FA? I agree insofar as, this is exactly why I strongly believe that 2FA should always be optional. But, if the user has chosen to use 2FA (or has not opted out), what’s wrong with SMS?
AshamedCaptain 4y ago
Before the "standardization" on SMS first and later on Google/Apple systems, there were a number of methods, since banks did try to do R&D to cut out on fraud: * One-time-pads (yes, I had a bank that would give me a card with 50 codes you were supposed to use once, then go back to the branch for more. Didn't last long, though, and was replaced with:) * Reusable codes: bank gives you a card with 50 codes. Bank randomly asks you for code number X. X may eventually repeat over time. (Bank also tells you your specific card serial number so that you can identify them). * Credit cards housing an actual e-Ink display that would give TOTP codes. https://www.e-ink-info.com/e-ink-used-create-dynamic-cvv-credit-cards https://www.e-ink-info.com/e-ink-used-create-dynamic-cvv-cre... * Actual FIDO devices.
- aenis 4y ago
  My bank issues a fido device: a card scanner with a built in camera that reads qr codes. Excellent tool, but for a few years now the bank is actively discouraging its use, touting the benefits of apps instead. It costs them around 60 euro to issue the device, and, sadly, thats incentive enough to advocate less secure solutions. When they take it away from me, I am out of options as this is the last bank in my country that issues them to individuals :-/
  - teekert 4y ago
    Rabobank? Yes it’s nice but I always find it a pain haha. 60€ wow, when they were first send around they very easily gave me 2 extra to put at work etc. What about N26, I don’t remember needing the app and I can log into a website. Not sure though…
cm2187 4y ago
Not really a technical challenge. You could force an equivalent of POSIX, maybe based on WASM, that smartphone makers would be forced to support if they want to sell in your region, and forced to support side loading those apps, as no government should be subject to the caprices of the various app stores. At this point smartphones have a fairly mature feature set to expose to the app. That would also help with the anti-competitive app store practices.
rsync 4y ago
"What's the alternative? SMS 2FA is abysmal." It seems to be forgotten that email 2FA exists. I can't quantify the risks relative to SMS 2FA because there are such broad ranging implementations but given the broad adoption of gmail, how many people can really snoop unencrypted email traffic at backbone chokepoints ? There are many cases where I would be perfectly happy with the risk profile of either SIM swap attacks or email interception.
- daveoc64 4y ago
  The main problem with email 2FA is that if someone gains access to your email account, they can reset your passwords on many sites and services. They can then bypass both the password (by resetting it) and the 2FA (by simply reading your emails). Even better, if you re-use passwords, they can use one password to access your email account and the service, and get the 2FA token via email.
  - wlecometo 4y ago
    if someone gets access to your phone they can do way more damage, but this is accepted.
- jamal-kumar 4y ago
  It's a lot easier to compromise an enormous purchased batch of email addresses than it is to do SIM swapping attacks on that scale
mateo1 4y ago
One thing that can and must be fixed instantly is to legislate that these businesses can not deny their services to anyone, just like systemic banks and the post office.
polskibus 4y ago
Why is SMS 2FA abysmal?
- formerkrogemp 4y ago
  Can't your number be spoofed?
amelius 4y ago
> The problem is we're becoming sophisticated enough as a society that we are forced to rely on a few establishments to maintain that sophistication. Come on, we have open webbrowsers, which are 100x more difficult to implement than a chain of trust. Surely, somebody could come up with a reliable alternative.

layer8 4y ago

Maybe there’s a market for dual-OS-installation smartphones, as an extension of dual-SIM ones.

floren 4y ago

Can't you just use a credit card? Every time any HN discussion veers toward alternative smartphone OSes, for instance, people come out of the woodwork to talk about how they just couldn't possibly access their bank without an Android or iOS device... what are you all doing with your bank so often? I log in a couple times a month, from my PC, to check balances and pay my car loan. I've certainly never needed a damn app.

AshamedCaptain 4y ago
Most banks in the EU require 2FA _every time_ you use a credit card online, due to a EU directive: https://en.wikipedia.org/wiki/Strong_customer_authentication https://en.wikipedia.org/wiki/Strong_customer_authentication
- heavenlyblue 4y ago
  Yeah. My TSB bank recently implemented this: - enter credit card details on the website - got to the mobile app, enter second password - receive an SMS to my phone number with 2fa code - login into the app, approve the payment - enter first account password - go back to the website and click continue That’a all together with iOS FaceID enabler. Monzo is actually way simpler.
- Symbiote 4y ago
  I've started using MobilePay — the Danish send-money-to-anyone-with-a-phone-number system — rather than a debit/credit card wherever it's offered. I've usually provided my phone number already, as part of the delivery address, so it's a click to choose MobilePay, another to confirm the number, then I fingerprint-unlock the MobilePay app and swipe to confirm the payment request that appears.
  - rvense 4y ago
    It's not really "send-money-to-anyone-with-a-phone-number", it's "send-money-to-anyone-with-the-mobilepay-app-installed" - and it only works on iPhones and unrooted Android phones with Google services enabled. As someone who doesn't have it, it's very rapidly become the thing that makes me feel the most like a second-class citizen.

mFixman 4y ago

In case you are still looking for a card that will work without an app, American Express sends you emails and SMSs with validation codes for online purchases.

jeroenhd 4y ago

My bank doesn't seem to do root detection. I haven't tried it on a phone without at least microgapps but I'm pretty sure that it just works. Even on LineageOS with root I never really had any problems. I do recall seeing a popup at one point ("hey we see you've done some weird shit to your phone, call us if you don't knowewhat rooting means" or something like that) but that's really just about it. I should try running it in Anbox, come to think of it. Would be a fun experience. If you're a developer in the EU and you think you can do better, the PSD2 system is set up to allow for fintech solutions like these. You'll need to get the necessary documentation in order, or even a license, to get access to actual banking APIs (thank goodness) but from that point on you should be able to write your own app. You'll have to be very careful, though, you don't want to anger the financial regulators.

rainmaking 4y ago
Which bank is that? My bank sees weird shit on my phone, it shuts down with no error message. I want in.
- jeroenhd 4y ago
  Your mileage may vary, but https://ing.nl/ https://ing.nl/ has been working great for me. Probably not as good outside the Netherlands. https://https://play.google.com/store/apps/details?id=com.ing.mobile&hl=nl&gl=US https://https://play.google.com/store/apps/details?id=com.in... Also, I tried running the app in Anbox but there's no x86 build of the APK and Google's ARM Android emulator is just broken these days, the VM doesn't even boot.
  - ThePowerOfFuet 4y ago
    Bunq's app works great on GrapheneOS without any Google services installed whatsoever.

ThePowerOfFuet 4y ago

FWIW, Bunq's app works on GrapheneOS without any Google services installed whatsoever.