4 ms·

In mainland Europe, banks used 2FA devices with a little lcd display since at least the early 2000s. Now they're going more phone based which feels like a step

In mainland Europe, banks used 2FA devices with a little lcd display since at least the early 2000s. Now they're going more phone based which feels like a step back to me (but more convenient of course... though I hate the kind that makes you film a colored qr code from your pc monitor: doesn't work in mobile browser since phone camera can't look at its own screen, and makes you look like photographing your pc screen)

InCityDreams 3y ago
Bastard bank charges me €20 for one of those LCD things. Luckily the battery lasts multiple years. The device particularly saved me when my phone got dropped and all i could do was email the world.
svennek 3y ago
In Denmark, we have a common login system called MitID (translated: MyID), which is used by all bank, insurance company, the governmental digital mail system (not email, but pdf's in a vault) and it still-alive now-commercial-only predecessor. I believe it is by law. The system is 2FA with either your phone or a hardware dongle proving your identity. It is strongly authenticating you as a person, that is precisely identified (but the services are only getting a token, but it can also validate your person-number - think SSN in US context). It is quite harsh in device security, recently failing on beta versions of Android - on top of afaik always failing on rooted devices... The phone version also requires you to scan a continuously changing qr-code twice to proceed, which is shown when you need to identify yourself (in an I-frame). This is to ensure you are "physically" present where you are being authenticated (i.e. to block of some phone scams). Works pretty well and is reasonable secure, whilst still having some flaws.. In the future, I believe this system will work in some/all of the EU due to the coming eIDAS legislation...

4 ms·

In mainland Europe, banks used 2FA devices with a little lcd display since at least the early 2000s. Now they're going more phone based which feels like a step

by Aardwolf 3y ago

InCityDreams 3y ago
Bastard bank charges me €20 for one of those LCD things. Luckily the battery lasts multiple years. The device particularly saved me when my phone got dropped and all i could do was email the world.
svennek 3y ago
In Denmark, we have a common login system called MitID (translated: MyID), which is used by all bank, insurance company, the governmental digital mail system (not email, but pdf's in a vault) and it still-alive now-commercial-only predecessor. I believe it is by law. The system is 2FA with either your phone or a hardware dongle proving your identity. It is strongly authenticating you as a person, that is precisely identified (but the services are only getting a token, but it can also validate your person-number - think SSN in US context). It is quite harsh in device security, recently failing on beta versions of Android - on top of afaik always failing on rooted devices... The phone version also requires you to scan a continuously changing qr-code twice to proceed, which is shown when you need to identify yourself (in an I-frame). This is to ensure you are "physically" present where you are being authenticated (i.e. to block of some phone scams). Works pretty well and is reasonable secure, whilst still having some flaws.. In the future, I believe this system will work in some/all of the EU due to the coming eIDAS legislation...