4 ms·
The solution is that banks should support any TOTP client for authentication and not just their proprietary app. So you can use open source software or a hardwa
by sumuyuda 2y ago
The solution is that banks should support any TOTP client for authentication and not just their proprietary app. So you can use open source software or a hardware key.
- sebazzz 2y agoThe ING has a small Android based single-purpose authenticator device they offer to customers without smartphones. It can scan the QR code and do the auth.
- everdrive 2y agoBut they won't. HN is quite good at suggesting a lot of genuinely intelligent and valid potential technical solutions, but most banks won't even think about supporting TOTP broadly. They'll lean into smartphones and apps because this is where the bast majority of their customers are. In this case the 'tyranny' is the overwhelming preference of other people. The masses have spoken, and they want everything to be on their phones.
- iforgotpassword 2y agoAlso because ticking boxes. You just provide an app that fulfills all the silly security requirements for banking apps and then if something goes wrong, the customer has the burden of proving it's the banks fault. I've had my banking app installed on an old Samsung phone running lineageos. I only powered it on when I had to do online banking. At some point I needed to update the app and they started checking for rooted devices, so it wouldn't work anymore. Now I've installed it on a much newer android device that I also use for a lot of other crap and sketchy stuff I don't want on my main phone. Also it's powered on all the time. Whether that's really more secure than what I did before is questionable.
- hsbauauvhabzb 2y agoMaybe not for you, but rooted phones are a legitimate risk for users that do sideload pirated games and malware etc. I still think the risks are arbitrary, but I can understand why banks want to avoid rooted phones
- lucb1e 2y agoThen they should also avoid rooted Windows machines where malware is a legitimate risk and orders of magnitude more prevalent than on mobile. Doing one but not the other is arbitrary and just pushes people towards having a locked-down device that they don't fully control with them all the time (can't uninstall tracking software from the vendor, for example). A locked-down computer that just sits in your office all day would be less worrisome
- hsbauauvhabzb 2y agoIf they could enforce locked down desktops, I’m sure they would.
- lucb1e 2y agoThey could have just chosen to not offer the service, but apparently that's okay
- szundi 2y ago[dead]
- nkrisc 2y agoAnd that’s where the government needs to step in order in order to advocate for the minority.
- Kwpolska 2y agoCan your TOTP client show what operation you’re approving? Because my bank app can.
- adrian_b 2y agoI had a couple of such TOTP clients from different banks. For approving an operation, both of them required me to sign the amount of money transferred by that operation (i.e. they generated a one-time code that depended on a hash of the amount of money), so no confusions were possible.
- mr_mitm 2y agoA chip TAN generator can. I'm glad my bank is still supporting those.