5 ms·

But except for some dinosaurs insisting on SMS (which you can receive on a dumb-as-bricks phone), you can absolutely have 2FA without a smartphone. Most passwor

But except for some dinosaurs insisting on SMS (which you can receive on a dumb-as-bricks phone), you can absolutely have 2FA without a smartphone. Most password managers handle it, with the bonus points of checking the domain when entering the TOTP. If you want separate baskets for your eggs, you can use dedicated TOTP apps (Authy works fine for my needs). You can even roll your own. You can use an external token like a YubiKey. I may be missing something, but I have a really hard time understanding the "corporate backdoor / overwatch / control" argument when it comes to MFA.

swiftcoder 3y ago
Where I live the banks all require that you install their own smartphone app in order to confirm transactions. Literally not possible to confirm online transactions with a dumb phone (or a laptop for that matter, unless you can run the mobile app in an emulator).
- vladvasiliu 3y ago
  In my case, I think something must have happened because that used to be the case. You might be able to jump through some hoops to avoid that (never tried), but the funny thing is that I didn't do anything with my "professional" account for it to automatically switch back to SMS. The first time it happened, I was actually surprised and thought something fishy was going on.
  - Al-Khwarizmi 3y ago
    Maybe some law forcing that has passed in your country? I would find it odd that banks would voluntarily decide to stop forcing their app on users.
    - vladvasiliu 3y ago
      I'm not aware of any such law. What I suspect, is it has something to do that the app can only connect to one account, but in my case I have two (personal and pro), so it must have some issue handling both. I freelance in IT, so there's nothing too interesting going on in my professional account, so I expect them not to care too much, since I have the app for my personal account anyway.
- KronisLV 3y ago
  > Where I live the banks all require that you install their own smartphone app in order to confirm transactions. Same here in the Baltics, something like SmartID is prevalent and all major banks ask you to use it: https://www.smart-id.com/ https://www.smart-id.com/ Sometimes it's even integrated with document e-signing, to the point where it's hard to say where convenience ends and dependence begins (since something like TOTP or PGP aren't offered as alternatives).
  - vladvasiliu 3y ago
    After a quick glance over the site, it seems the system is fairly open, and they explain how they use the keys. The part on which I'm not clear is the app: is it not possible to build your own app that complies with their various interfaces, which would run on, say, a PC? Those seem to be documented.
    - TeMPOraL 3y ago
      I doubt the bank will let me run an alternative app to their "tap 'yes' and type in your mobile PIN within the next 3 minutes to confirm the operation" functionality. Hell, after I broke my phone, I had to call the bank's support for them to manually authorize the new instance of their app as an "authorization tool". If there are procedures to do this with third-party software, I haven't heard or seen them mentioned anywhere, much less documented.
      - vladvasiliu 3y ago
        I was talking about the smart-id scheme, which seems to be a "generic" thing, to be used by random different things. For banks, I don't think that they'll allow use of 3rd party apps, either.

swiftcoder 3y ago

Where I live the banks all require that you install their own smartphone app in order to confirm transactions. Literally not possible to confirm online transactions with a dumb phone (or a laptop for that matter, unless you can run the mobile app in an emulator).

vladvasiliu 3y ago
In my case, I think something must have happened because that used to be the case. You might be able to jump through some hoops to avoid that (never tried), but the funny thing is that I didn't do anything with my "professional" account for it to automatically switch back to SMS. The first time it happened, I was actually surprised and thought something fishy was going on.
- Al-Khwarizmi 3y ago
  Maybe some law forcing that has passed in your country? I would find it odd that banks would voluntarily decide to stop forcing their app on users.
  - vladvasiliu 3y ago
    I'm not aware of any such law. What I suspect, is it has something to do that the app can only connect to one account, but in my case I have two (personal and pro), so it must have some issue handling both. I freelance in IT, so there's nothing too interesting going on in my professional account, so I expect them not to care too much, since I have the app for my personal account anyway.
KronisLV 3y ago
> Where I live the banks all require that you install their own smartphone app in order to confirm transactions. Same here in the Baltics, something like SmartID is prevalent and all major banks ask you to use it: https://www.smart-id.com/ https://www.smart-id.com/ Sometimes it's even integrated with document e-signing, to the point where it's hard to say where convenience ends and dependence begins (since something like TOTP or PGP aren't offered as alternatives).
- vladvasiliu 3y ago
  After a quick glance over the site, it seems the system is fairly open, and they explain how they use the keys. The part on which I'm not clear is the app: is it not possible to build your own app that complies with their various interfaces, which would run on, say, a PC? Those seem to be documented.
  - TeMPOraL 3y ago
    I doubt the bank will let me run an alternative app to their "tap 'yes' and type in your mobile PIN within the next 3 minutes to confirm the operation" functionality. Hell, after I broke my phone, I had to call the bank's support for them to manually authorize the new instance of their app as an "authorization tool". If there are procedures to do this with third-party software, I haven't heard or seen them mentioned anywhere, much less documented.
    - vladvasiliu 3y ago
      I was talking about the smart-id scheme, which seems to be a "generic" thing, to be used by random different things. For banks, I don't think that they'll allow use of 3rd party apps, either.