3 ms·

Related: I have EU bank accounts and each bank wants me to use some app as a second factor (it's not TOTP). The apps are large, I don't trust them, and I don't

Related: I have EU bank accounts and each bank wants me to use some app as a second factor (it's not TOTP). The apps are large, I don't trust them, and I don't have access to e.g. Play store (of course, no bank serves the app on F-Droid) because I use google-free LineageOs on my phone. Is there any way to use a single FOSS app instead of the crap each bank is serving me? Both desktop and phone apps would be ok.

adityamwagh 3y ago
I use Microsoft Authenticator personally on iOS and Windows. BitWarden is a good Open Spurce option, it’s cross platform but the TOPT stuff is available only with a paid plan.
- stefan_ 3y ago
  Microsoft Authenticator is the app that would literally refuse to work unless you first consented to data sharing and telemetrics. No fucking go. Thankfully, F-Droid has a useful alternative (Android only, of course): https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis
- kramerger 3y ago
  Pro tip: install a VPN firewall (such as NetGuard on Android). Now watch MS Authenticators do tons of network connections to various Microsoft services and analytics servers every 5 seconds or so. Probably same with Googles app.
red_admiral 3y ago
The issue with TOTP here is it can only provide a 6-digit code, whereas an app can show for example "Do you want to authorise $6.21 at McDonalds?" before sending a transaction through. Grudgingly, I will accept that for most of the customer base this is probably the correct solution. If there is a move in this area, I predict it will come from something like EU regulations on interoperability (we already have rules on Open Banking to some extent) - something to bear in mind next time the EU's approach to regulation is criticised as "anti-tech".
- KronisLV 3y ago
  > If there is a move in this area, I predict it will come from something like EU regulations on interoperability (we already have rules on Open Banking to some extent) - something to bear in mind next time the EU's approach to regulation is criticised as "anti-tech". This would actually be really cool! Over here in the Baltics most banks expect you to use SmartID, which admittedly is fine and has some source up on GitHub, even some nice documentation: https://github.com/SK-EID/smart-id-documentation https://github.com/SK-EID/smart-id-documentation But more implementations and support for less vendor lock-in is nice, except that in the case of confirming bank authentication/transactions, there's probably a rather serious matter of trust and security at play (made harder by all of the complexity that you have to deal with). That said, if there was a large community effort, I'm sure that the end result would still be good for creating something like that.
tremon 3y ago
My bank (in NL) provides a separate device for authorization. It has a camera to scan a colour-coded QR code, then lets you see the total amount you're authorizing on its screen, and gives you a TOTP code to confirm the transaction. Having a separate device may not be what you're looking for, but for me it beats installing a closed-source app on my phone.

adityamwagh 3y ago

I use Microsoft Authenticator personally on iOS and Windows. BitWarden is a good Open Spurce option, it’s cross platform but the TOPT stuff is available only with a paid plan.

stefan_ 3y ago
Microsoft Authenticator is the app that would literally refuse to work unless you first consented to data sharing and telemetrics. No fucking go. Thankfully, F-Droid has a useful alternative (Android only, of course): https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis
kramerger 3y ago
Pro tip: install a VPN firewall (such as NetGuard on Android). Now watch MS Authenticators do tons of network connections to various Microsoft services and analytics servers every 5 seconds or so. Probably same with Googles app.

red_admiral 3y ago

The issue with TOTP here is it can only provide a 6-digit code, whereas an app can show for example "Do you want to authorise $6.21 at McDonalds?" before sending a transaction through. Grudgingly, I will accept that for most of the customer base this is probably the correct solution. If there is a move in this area, I predict it will come from something like EU regulations on interoperability (we already have rules on Open Banking to some extent) - something to bear in mind next time the EU's approach to regulation is criticised as "anti-tech".

KronisLV 3y ago
> If there is a move in this area, I predict it will come from something like EU regulations on interoperability (we already have rules on Open Banking to some extent) - something to bear in mind next time the EU's approach to regulation is criticised as "anti-tech". This would actually be really cool! Over here in the Baltics most banks expect you to use SmartID, which admittedly is fine and has some source up on GitHub, even some nice documentation: https://github.com/SK-EID/smart-id-documentation https://github.com/SK-EID/smart-id-documentation But more implementations and support for less vendor lock-in is nice, except that in the case of confirming bank authentication/transactions, there's probably a rather serious matter of trust and security at play (made harder by all of the complexity that you have to deal with). That said, if there was a large community effort, I'm sure that the end result would still be good for creating something like that.

tremon 3y ago

My bank (in NL) provides a separate device for authorization. It has a camera to scan a colour-coded QR code, then lets you see the total amount you're authorizing on its screen, and gives you a TOTP code to confirm the transaction. Having a separate device may not be what you're looking for, but for me it beats installing a closed-source app on my phone.