5 ms·

Just use the bank's PWA, you'll be fine. Or sandboxed play services in a separate GOS user.

aftbit 3y ago
Outside of the USA, some banks require mobile apps. If you don't have a working attested phone in these countries, banking becomes decidedly 20th century.
vetinari 3y ago
It is different issue than that. European banks are forced by EU's Payment Services Directive 2 (PSD2) to authenticate using MFA for any payment over 50 EUR. So what is the second factor? Your phone. Once you pair the app in your phone with your account, you can authenticate your actions using that phone, even if you are otherwise banking using the web app on your computer. Most banks also insist on using their apps, they don't allow generic second factors. Since their apps require Android with SafeNet or iOS, they pretty much enforce the Google/Apple duopoly. For now, there are other ways -- sms, which the banks are trying to phase out. So I imagine situation elsewhere will be very similar.
- daef 3y ago
  I don't know where you're from, but here in austria most banks offer 'cardTAN' as an alternative to mobileTAN. I always assumed cardTAN is a thing everywhere... edit: with cardTAN you get a OTP/TAN 'calculator' into which you put your smartcard to generate TANs on the fly. I use it because to me this feels more like a real second factor, when I use my mobile for banking.
  - vetinari 3y ago
    The DACH world is specific in many things... but I've seen cardTAN outside it. In Slovakia, Tatra banka does use this system. I guess being part of Raiffeisen explains it.
  - 4ad 3y ago
    cardTAN is being rapidly phased out in Austria.
  - jacquesm 3y ago
    Same here in NL, for now. But: banks are pushing their apps hard, to the point where every authentication you have to manually switch - again - to indicate that you want to use the token generator and not their app (never mind cookies and so on, those are only for the marketing department, when for once they could actually use them to store your preferences). And there will likely be a time when the bank simply cuts access to the cardTAN system and only allow their apps. Screw them because that means I have to use a smartphone, which I really do not want. The cardTAN system has been very good so far in preventing fraud, once the phone is the token it suddenly gets a lot more complicated and less secure.
  - wink 3y ago
    Fun fact, I still have the thing here, used it for many years, but they made it obsolete. App only now. It's a German Sparkasse :(
  - PeterStuer 3y ago
    That used to be the universal way here (Belgium) before the banks went all in with apps. I'm not sure wether typing a challange/response into a browser is inherently more secure than a phone app. For those wondering about 2FA with these apps, factor 1 is "something you own" namely that particular phone/sim, and factor 2 is "something you know", your PIN. You can still use cardTAN, but the app is way more convenient, especially with QR.
- liotier 3y ago
  My French bank, CIC, sold me a Digipass scanner+pin authentication device. Adding yet another device to the usual kit bag won't make it very popular but an option independent from Google/Apple exists and I guess that its non-existence wouldn't fly for long with regulatory authorities. https://www.onespan.com/products/transaction-signing/cronto/digipass-770 https://www.onespan.com/products/transaction-signing/cronto/...
- kaliszad 3y ago
  Banks have no clue about 2FA/ MFA, they will happily put the bank app and the custom TOTP generator/ "key"-app on the same phone or, as a fallback, send SMS to the same phone the bank app is on. So in reality, it's at best 1.5FA because when the phone is owned, the user already lost. And it is really hard to not have the banking app on the phone with many institutions. Some institutions now put the TOTP generation into the same app too. Oh and there are limits on the user name and password-length that make it easier for attackers to crack, in some cases (in Germany) the password can be exactly 5 characters long and the username tends to be the debit card number by default. In many ways, this is really cumbersome, not really secure and on top of everything else adding a false sense of security. Less advanced customers are either somewhat secure but then the product is barely usable or they can realistically use the service but the security is so-so.
  - vladvasiliu 3y ago
    > Banks have no clue about 2FA/ MFA, they will happily put the bank app and the custom TOTP generator/ "key"-app on the same phone or, as a fallback, send SMS to the same phone the bank app is on. This. My bank in France, BNP, does that. Every so often, when I connect to the app on the phone, it says something similar to "in accordance with <some regulation> a strong authentication must be made every <number> of sign-ins". You're presented with only one button that says something like "ok". You press it, and you're in business. This is after requiring me to type in my pin, which must be precisely 6 digits, and some sequences are forbidden, so you can't type 1234 or similar. It doesn't seem to interact with the secure enclave in any way. If this number of sign-ins is reached while I'm on a PC (which is the most likely), it'll send a confirmation request on the phone, so at least it works there. When paying online, I'll also get a confirmation request on the phone app. On my professional account, with the same bank, the situation used to be exactly the same. But a few months ago, they switched away from that to sending a confirmation code via SMS for bank transfers. Credit card payments still have the app confirmation request.
  - usrusr 3y ago
    They do? My bank is very explicit about "don't ever run the front-end and the second factor on the same device". Perhaps it's a German thing, with all our Datenschutz fundamentalism that will happily consider even IP addresses PII?
- nilespotter 3y ago
  > Since their apps require Android with SafeNet or iOS, they pretty much enforce the Google/Apple duopoly. That is positively insane. So if you don't use vanilla Android or iOS, you can't use a credit card for more than 50EUR? No phone, dumb phone, too bad?
Izkata 3y ago
> Just use the bank's PWA, you'll be fine. Just over a month ago, a proposal to prevent that was posted here: https://news.ycombinator.com/item?id=36875940 https://news.ycombinator.com/item?id=36875940
- bob1029 3y ago
  The authors of the PWAs would need to opt-in to this. We distribute LOB banking apps as PWAs to our customers. In no reality would I consider incorporating this into our tech stack. We use PWAs and avoid native apps precisely to maximize compatibility across arbitrary IT policies in our various customer installs. I don't know if our customers want to use linux, windows, android or apple. I don't WANT to know anymore. I just want to target a common API (HTML5), add some bandaids for iOS/Safari (usually after WWDC each year) and move on with life. Throwing DRM and platform constraints into the mix sounds like I might as well go back to native (I won't). We are one of the few vendors that will actually get into a heated argument and push back against customers over FUD security crap like this. If a prospect insists that we add some draconian DRM to our product stack, I would make it very clear to leadership that I do not think we should do business with that customer on technical grounds. If you find yourself in a situation where you need to trust the client implicitly, then you have catastrophically failed in the rest of your design.
  - jabroni_salad 3y ago
    I appreciate what you do if you really do deliver that, but plenty of FIs are happy to mandate things like Trusteer Rapport and I would anticipate that sector to jump onto WEI just as fast as media companies will. It's going to be sold to execs as a zero operational cost lightswitch solution to preventing account hijacks. Up until about a year ago one major core provider had been using the password 'money' for all their client accounts, many of which were domain admins since that is a 'just make it work' button and they cannot actually tell you what privs their service accounts need. When we asked the clients to press them on it, we determined via cracking that they had changed it to 'monet' as a workaround. The standards for excellence are SO LOW.
    - 3y ago
Spoom 3y ago
Check deposit and Zelle is only available in the app.

Outside of the USA, some banks require mobile apps. If you don't have a working attested phone in these countries, banking becomes decidedly 20th century.

vetinari 3y ago

It is different issue than that. European banks are forced by EU's Payment Services Directive 2 (PSD2) to authenticate using MFA for any payment over 50 EUR. So what is the second factor? Your phone. Once you pair the app in your phone with your account, you can authenticate your actions using that phone, even if you are otherwise banking using the web app on your computer. Most banks also insist on using their apps, they don't allow generic second factors. Since their apps require Android with SafeNet or iOS, they pretty much enforce the Google/Apple duopoly. For now, there are other ways -- sms, which the banks are trying to phase out. So I imagine situation elsewhere will be very similar.

daef 3y ago
I don't know where you're from, but here in austria most banks offer 'cardTAN' as an alternative to mobileTAN. I always assumed cardTAN is a thing everywhere... edit: with cardTAN you get a OTP/TAN 'calculator' into which you put your smartcard to generate TANs on the fly. I use it because to me this feels more like a real second factor, when I use my mobile for banking.
- vetinari 3y ago
  The DACH world is specific in many things... but I've seen cardTAN outside it. In Slovakia, Tatra banka does use this system. I guess being part of Raiffeisen explains it.
- 4ad 3y ago
  cardTAN is being rapidly phased out in Austria.
- jacquesm 3y ago
  Same here in NL, for now. But: banks are pushing their apps hard, to the point where every authentication you have to manually switch - again - to indicate that you want to use the token generator and not their app (never mind cookies and so on, those are only for the marketing department, when for once they could actually use them to store your preferences). And there will likely be a time when the bank simply cuts access to the cardTAN system and only allow their apps. Screw them because that means I have to use a smartphone, which I really do not want. The cardTAN system has been very good so far in preventing fraud, once the phone is the token it suddenly gets a lot more complicated and less secure.
- wink 3y ago
  Fun fact, I still have the thing here, used it for many years, but they made it obsolete. App only now. It's a German Sparkasse :(
- PeterStuer 3y ago
  That used to be the universal way here (Belgium) before the banks went all in with apps. I'm not sure wether typing a challange/response into a browser is inherently more secure than a phone app. For those wondering about 2FA with these apps, factor 1 is "something you own" namely that particular phone/sim, and factor 2 is "something you know", your PIN. You can still use cardTAN, but the app is way more convenient, especially with QR.
liotier 3y ago
My French bank, CIC, sold me a Digipass scanner+pin authentication device. Adding yet another device to the usual kit bag won't make it very popular but an option independent from Google/Apple exists and I guess that its non-existence wouldn't fly for long with regulatory authorities. https://www.onespan.com/products/transaction-signing/cronto/digipass-770 https://www.onespan.com/products/transaction-signing/cronto/...
kaliszad 3y ago
Banks have no clue about 2FA/ MFA, they will happily put the bank app and the custom TOTP generator/ "key"-app on the same phone or, as a fallback, send SMS to the same phone the bank app is on. So in reality, it's at best 1.5FA because when the phone is owned, the user already lost. And it is really hard to not have the banking app on the phone with many institutions. Some institutions now put the TOTP generation into the same app too. Oh and there are limits on the user name and password-length that make it easier for attackers to crack, in some cases (in Germany) the password can be exactly 5 characters long and the username tends to be the debit card number by default. In many ways, this is really cumbersome, not really secure and on top of everything else adding a false sense of security. Less advanced customers are either somewhat secure but then the product is barely usable or they can realistically use the service but the security is so-so.
- vladvasiliu 3y ago
  > Banks have no clue about 2FA/ MFA, they will happily put the bank app and the custom TOTP generator/ "key"-app on the same phone or, as a fallback, send SMS to the same phone the bank app is on. This. My bank in France, BNP, does that. Every so often, when I connect to the app on the phone, it says something similar to "in accordance with <some regulation> a strong authentication must be made every <number> of sign-ins". You're presented with only one button that says something like "ok". You press it, and you're in business. This is after requiring me to type in my pin, which must be precisely 6 digits, and some sequences are forbidden, so you can't type 1234 or similar. It doesn't seem to interact with the secure enclave in any way. If this number of sign-ins is reached while I'm on a PC (which is the most likely), it'll send a confirmation request on the phone, so at least it works there. When paying online, I'll also get a confirmation request on the phone app. On my professional account, with the same bank, the situation used to be exactly the same. But a few months ago, they switched away from that to sending a confirmation code via SMS for bank transfers. Credit card payments still have the app confirmation request.
- usrusr 3y ago
  They do? My bank is very explicit about "don't ever run the front-end and the second factor on the same device". Perhaps it's a German thing, with all our Datenschutz fundamentalism that will happily consider even IP addresses PII?
nilespotter 3y ago
> Since their apps require Android with SafeNet or iOS, they pretty much enforce the Google/Apple duopoly. That is positively insane. So if you don't use vanilla Android or iOS, you can't use a credit card for more than 50EUR? No phone, dumb phone, too bad?

Izkata 3y ago

> Just use the bank's PWA, you'll be fine. Just over a month ago, a proposal to prevent that was posted here: https://news.ycombinator.com/item?id=36875940 https://news.ycombinator.com/item?id=36875940

bob1029 3y ago
The authors of the PWAs would need to opt-in to this. We distribute LOB banking apps as PWAs to our customers. In no reality would I consider incorporating this into our tech stack. We use PWAs and avoid native apps precisely to maximize compatibility across arbitrary IT policies in our various customer installs. I don't know if our customers want to use linux, windows, android or apple. I don't WANT to know anymore. I just want to target a common API (HTML5), add some bandaids for iOS/Safari (usually after WWDC each year) and move on with life. Throwing DRM and platform constraints into the mix sounds like I might as well go back to native (I won't). We are one of the few vendors that will actually get into a heated argument and push back against customers over FUD security crap like this. If a prospect insists that we add some draconian DRM to our product stack, I would make it very clear to leadership that I do not think we should do business with that customer on technical grounds. If you find yourself in a situation where you need to trust the client implicitly, then you have catastrophically failed in the rest of your design.
- jabroni_salad 3y ago
  I appreciate what you do if you really do deliver that, but plenty of FIs are happy to mandate things like Trusteer Rapport and I would anticipate that sector to jump onto WEI just as fast as media companies will. It's going to be sold to execs as a zero operational cost lightswitch solution to preventing account hijacks. Up until about a year ago one major core provider had been using the password 'money' for all their client accounts, many of which were domain admins since that is a 'just make it work' button and they cannot actually tell you what privs their service accounts need. When we asked the clients to press them on it, we determined via cracking that they had changed it to 'monet' as a workaround. The standards for excellence are SO LOW.
  - 3y ago

Spoom 3y ago

Check deposit and Zelle is only available in the app.