7 ms·

What if we collectively decide to use the web alternatives for banking? We lose some convinience since they are generally desktop oriented, but they don't check

What if we collectively decide to use the web alternatives for banking? We lose some convinience since they are generally desktop oriented, but they don't check who signed my kernel

lifthrasiir 1y ago
Except they did in several countries, typically using activeX.
1gn15 1y ago
Also, use ATMs if you can instead. Don't use propietary code on your own machine; run it on theirs instead.
- falcor84 1y ago
  I don't understand the sentiment - how does relinquishing control of the hardware help us? I see a possible future where the banks/governments give the people devices to use for these things, and I don't like this future, as these would surely become spy instruments.
  - p0w3n3d 1y ago
    It sounds like an implementation of the Orwell's 1984 telescreen
  - card_zero 1y ago
    In what way, if supplied by the bank and used only for contacting the bank to do banking, could a device become a spy instrument? Kicking banks off the internet/apps would make Android and Apple less cushy.
    - falcor84 1y ago
      > In what way, if supplied by the bank and used only for contacting the bank to do banking, could a device become a spy instrument? Here's my attempt at future history: Firstly they'll require you to prove your current location, to ensure that the request isn't made by a remote hacker; they'll do this by integrating their own cellular modem, as well as scanning local wi-fi networks. Then, at a second phase, they'll integrate a camera and microphone to perform a face identification, asking you to speak out a particular phrase while performing a particular motion. At the start they'll only require you to turn the mic and camera on during active usage, but eventually they'll say that these have to stay on continuously so that they can ensure that the device wasn't tempered with. And if we aren't careful, we'll accept every single small added requirement, until we're boiled alive.
      - card_zero 1y ago
        If it was normal and expected that you carry the device around, to make purchases with, then all that would be very bad, and it becomes like a phone but worse in some ways (less ownership over it) and better in others (does not contain other personal data). However, if it sits at home in a drawer, it can keep its camera on all it likes, transmitting images of darkness, and tell the bank repeatedly where your home address is, and sometimes (when in use) confirm what your face looks like. Not a privacy issue I think? Probably it would become expected that you carry the thing around and it replaces cash and cards, but that seems to me to be the crucial step if it's going to have meaningful potential for spying.
  - defanor 1y ago
    Not OP, but sharing the sentiment (never had banking or similar software on a phone, yet using ATMs, banks' web interfaces, offices). Avoiding interaction with a bank completely is rarely viable these days, and they will run their software on their hardware to operate either way (whether it is an ATM, a bank office, or a website). I do not see it as relinquishing control of the hardware, since you are not expected to control a bank's hardware in the first place. While setting it on your phone comes with the usual risks of running proprietary software on your machines, such as sneaky data collection. If banks/governments will give mobile devices to people for that, those may act even a little more like electronic ankle bracelets, but they would also be isolated from your other data and software; in places with near-mandatory government software, some choose to create such an isolation by having multiple devices for different purposes.
  - zigzag312 1y ago
    > how does relinquishing control of the hardware help us It's not relinquishing control, but separation of concerns for hardware. Bank should manage their hardware, not your hardware.
    - 1gn15 1y ago
      Yep! Thanks for helping me put my points across better. It's like having a separate work computer, for example. Okay, I guess more to the point, I don't want the banking app forcing the OS that I use. They can provide their own damn hardware!
  - dotancohen 1y ago
    > the banks/governments give the people devices to use for these things, Give? The devices will cost "a reasonable amount" and have GPS tracking "for your safety".
    - sigio 1y ago
      Most banks here (nl) give you a dumb coincell battery powered code-calculator, either with or without smartcard access to your banking-card. Basically some form of TOTP or challenge-response system. Those devices have no network, no connectity, no gps, and no interface besides a tiny 7-segment lcd display and some 0-9 buttons for pincode entry.
      - dotancohen 1y ago
        I'd be satisfied with that.
- PeterStuer 1y ago
  ATM's are disapearing. There used to be one at every corner. Now, I have to travel to the next village that has just one left at the train station. Cash is positioned as suspicious. In 10 years, it might very well be illegal.
  - scrubs 1y ago
    Not in the US... have you seen the first or second Shrek movie where a monster busts in on a Starbucks and all the scared customers run across the street to another Starbucks? Like a virus they're everywhere. Same thing for atm machines. Cash is doing just fine.
thombles 1y ago
My bank recently made it that app-based MFA must be used for every single web login. Unless I and many others are willing to swap banks in the vain hope that the new bank won't do the same thing (I am not), then we're cooked.
- dingnuts 1y ago
  fuck it back to cash
  - sterlind 1y ago
    I stayed away from cryptocurrency when DeFi and Web3 and NFTs were everywhere, but I've started paying with BTC where I can, so I don't have to deal with banking apps, and to stick it to puritanical payment processors, after the Steam/Itch debacle. Know Your Customer is acceptable. Nanny Your Customer is not.
    - uyzstvqs 1y ago
      Monero is the cryptocurrency everyone uses for this. The userbase and community is completely separate from the Web3 NFT dog-coin crowd (unlike Bitcoin). There's also systems like PaySafeCard, which is accepted by Steam.
      - sterlind 1y ago
        I'm really interested in Monero. I feel kinda nervous about using it, though, since even though everything I'm buying is legal, it feels like I'd be calling a lot of attention, and I want to make sure I'm buying and exchanging it in legal (if private) ways.
        uyzstvqs 1y ago
        Using Monero is not much different from using Bitcoin. It's actually safer than Bitcoin in this regard, as you can't accidentally receive coins that are "tainted" by what previous owners did with them.
MathMonkeyMan 1y ago
I uninstalled banking related apps from my phone years ago. I used it so infrequently that every time I did use it, it was as if it had been newly installed and didn't remember anything about me. Now I use a desktop web browser for anything finance (and it's Firefox on Linux, so thankfully that works for now).
- pastage 1y ago
  The phone will be used as MFA, and that will have requirements especially on Android versions. So it is going to be harder to escape it, it is darn comfortable using Android as a MFA. Many banks still use a custom device for MFA here but is is slowly going away. BankID in Sweden and similar in other European countries.
  - PeterStuer 1y ago
    For now the custom issued 2FA is still an inconvenient option, but nearly everyone uses the phone for 2FA as it is so much faster.
- homebrewer 1y ago
  It's getting repetitive to come with the same message over and over and over again, but in many countries you can no longer interact with your bank through the web browser. The banks' applications are either required for 2FA, or are the only way to use remote banking at all. The last one applies in my country. You can of course go to the bank branch for every little financial operation, which is bad enough by itself for us living in cities, but is practically impossible for my relatives in the rural area, who would have to drive 100 km to the nearest bank branch, and then back just to move some money between two accounts. Even if you don't care for anyone else but your country, it will come to you also, I promise.
  - fsflover 1y ago
    You should at least complain to your bank and government, support NGOs fighting for your freedom like https://edri.org https://edri.org, https:/eff.org, or equivalent in your country. Forcing you to use foreign megacorps for essential services should be illegal if not already.
PeterStuer 1y ago
Many banks are slowly phasing out their websites to go app only.
- derwiki 1y ago
  Which ones?
  - kikokikokiko 1y ago
    every single Brazilian bank for instance
    - deleted 1y ago
      [deleted]
    - BlueTemplar 1y ago
      Brazil is screwed anyway from what I heard about WhatsApp being mandatory for daily life ?
      - homebrewer 1y ago
        Even though I very much dislike WhatsApp, it does not require having full control over "your" device, and does not make itself an arbiter of what you can or cannot install on "your" hardware. I can't see them changing this in the foreseeable future, major parts of their userbase run the cheapest phones one can buy, and they're much more interested in as much data as possible, so near 100% device coverage has to be important for them.
        BlueTemplar 1y ago
        Last time I tried to use WhatsApp (in 2024), it was also basically unusable, because after I gave it the barest amount of information during installation (using its own dialog screens !), (in particular not willing to share my contacts), it regularly locked me out (IIRC as not a 'real' user).
deleted 1y ago
[deleted]
sfdlkj3jk342a 1y ago
It's too late for that. In many Asian countries, most of the banks have completely removed access via a browser.
vkou 1y ago
> What if we collectively decide to use the web alternatives for banking? So, like, legislate it? Prior art exists on this point.
tim1994 1y ago
Ain't gonna happen (unfortunately). Somehow people (outside of HN) seem to like to use apps for everything. EVERYTHING.
sushhtr 1y ago
Can anyone confirm that the situation regarding authentication in EU will change with the PSD3 directive ? As far as I read the directive will require authentication methods to individuals without smartphones. Anyone alrady working on this ?
- prmoustache 1y ago
  All EU banks provide an hardware device if you ask for it already.
  - BlueTemplar 1y ago
    Not all. Mine was willing to downgrade me to SMS 2FA though.
matheusmoreira 1y ago
In my country banks have required users to install "security modules" to log into their accounts for decades now. Once upon a time I tried to crack one of these things open. I discovered they were literal device drivers running in kernel mode and I caught them intercepting every single network connection. Told me all I needed to know. They even have Linux versions: https://aur.archlinux.org/packages/warsaw https://aur.archlinux.org/packages/warsaw https://aur.archlinux.org/packages/warsaw-bin https://aur.archlinux.org/packages/warsaw-bin Who even knows what this malware does? I sure as hell don't want to find out. For the bank, things like "fraud prevention" override literally everything. There is no limit they wouldn't cross and there is no freedom they wouldn't trample in the pursuit of their goals.
- yonatan8070 1y ago
  Just... wow. People get so mad about kernel-level anti cheat in video games, but when your bank does it, I've never heard of it before. I sure am glad my bank doesn't do this for now.
  - matheusmoreira 1y ago
    The video games industry and the copyright monopolists were just the first bosses. Now we're dealing with banks. One day we'll have to deal with governments. They think everything they do is justified and necessary. They've got a "legitimate" reason to do it so it's alright. Because total nonsense like fraud prevention is totally worth giving up our freedom for.

What if we collectively decide to use the web alternatives for banking? We lose some convinience since they are generally desktop oriented, but they don't check who signed my kernel

lifthrasiir 1y ago

Except they did in several countries, typically using activeX.

1gn15 1y ago

Also, use ATMs if you can instead. Don't use propietary code on your own machine; run it on theirs instead.

falcor84 1y ago
I don't understand the sentiment - how does relinquishing control of the hardware help us? I see a possible future where the banks/governments give the people devices to use for these things, and I don't like this future, as these would surely become spy instruments.
- p0w3n3d 1y ago
  It sounds like an implementation of the Orwell's 1984 telescreen
- card_zero 1y ago
  In what way, if supplied by the bank and used only for contacting the bank to do banking, could a device become a spy instrument? Kicking banks off the internet/apps would make Android and Apple less cushy.
  - falcor84 1y ago
    > In what way, if supplied by the bank and used only for contacting the bank to do banking, could a device become a spy instrument? Here's my attempt at future history: Firstly they'll require you to prove your current location, to ensure that the request isn't made by a remote hacker; they'll do this by integrating their own cellular modem, as well as scanning local wi-fi networks. Then, at a second phase, they'll integrate a camera and microphone to perform a face identification, asking you to speak out a particular phrase while performing a particular motion. At the start they'll only require you to turn the mic and camera on during active usage, but eventually they'll say that these have to stay on continuously so that they can ensure that the device wasn't tempered with. And if we aren't careful, we'll accept every single small added requirement, until we're boiled alive.
    - card_zero 1y ago
      If it was normal and expected that you carry the device around, to make purchases with, then all that would be very bad, and it becomes like a phone but worse in some ways (less ownership over it) and better in others (does not contain other personal data). However, if it sits at home in a drawer, it can keep its camera on all it likes, transmitting images of darkness, and tell the bank repeatedly where your home address is, and sometimes (when in use) confirm what your face looks like. Not a privacy issue I think? Probably it would become expected that you carry the thing around and it replaces cash and cards, but that seems to me to be the crucial step if it's going to have meaningful potential for spying.
- defanor 1y ago
  Not OP, but sharing the sentiment (never had banking or similar software on a phone, yet using ATMs, banks' web interfaces, offices). Avoiding interaction with a bank completely is rarely viable these days, and they will run their software on their hardware to operate either way (whether it is an ATM, a bank office, or a website). I do not see it as relinquishing control of the hardware, since you are not expected to control a bank's hardware in the first place. While setting it on your phone comes with the usual risks of running proprietary software on your machines, such as sneaky data collection. If banks/governments will give mobile devices to people for that, those may act even a little more like electronic ankle bracelets, but they would also be isolated from your other data and software; in places with near-mandatory government software, some choose to create such an isolation by having multiple devices for different purposes.
- zigzag312 1y ago
  > how does relinquishing control of the hardware help us It's not relinquishing control, but separation of concerns for hardware. Bank should manage their hardware, not your hardware.
  - 1gn15 1y ago
    Yep! Thanks for helping me put my points across better. It's like having a separate work computer, for example. Okay, I guess more to the point, I don't want the banking app forcing the OS that I use. They can provide their own damn hardware!
- dotancohen 1y ago
  > the banks/governments give the people devices to use for these things, Give? The devices will cost "a reasonable amount" and have GPS tracking "for your safety".
  - sigio 1y ago
    Most banks here (nl) give you a dumb coincell battery powered code-calculator, either with or without smartcard access to your banking-card. Basically some form of TOTP or challenge-response system. Those devices have no network, no connectity, no gps, and no interface besides a tiny 7-segment lcd display and some 0-9 buttons for pincode entry.
    - dotancohen 1y ago
      I'd be satisfied with that.
PeterStuer 1y ago
ATM's are disapearing. There used to be one at every corner. Now, I have to travel to the next village that has just one left at the train station. Cash is positioned as suspicious. In 10 years, it might very well be illegal.
- scrubs 1y ago
  Not in the US... have you seen the first or second Shrek movie where a monster busts in on a Starbucks and all the scared customers run across the street to another Starbucks? Like a virus they're everywhere. Same thing for atm machines. Cash is doing just fine.

thombles 1y ago

My bank recently made it that app-based MFA must be used for every single web login. Unless I and many others are willing to swap banks in the vain hope that the new bank won't do the same thing (I am not), then we're cooked.

dingnuts 1y ago
fuck it back to cash
- sterlind 1y ago
  I stayed away from cryptocurrency when DeFi and Web3 and NFTs were everywhere, but I've started paying with BTC where I can, so I don't have to deal with banking apps, and to stick it to puritanical payment processors, after the Steam/Itch debacle. Know Your Customer is acceptable. Nanny Your Customer is not.
  - uyzstvqs 1y ago
    Monero is the cryptocurrency everyone uses for this. The userbase and community is completely separate from the Web3 NFT dog-coin crowd (unlike Bitcoin). There's also systems like PaySafeCard, which is accepted by Steam.
    - sterlind 1y ago
      I'm really interested in Monero. I feel kinda nervous about using it, though, since even though everything I'm buying is legal, it feels like I'd be calling a lot of attention, and I want to make sure I'm buying and exchanging it in legal (if private) ways.
      - uyzstvqs 1y ago
        Using Monero is not much different from using Bitcoin. It's actually safer than Bitcoin in this regard, as you can't accidentally receive coins that are "tainted" by what previous owners did with them.

MathMonkeyMan 1y ago

I uninstalled banking related apps from my phone years ago. I used it so infrequently that every time I did use it, it was as if it had been newly installed and didn't remember anything about me. Now I use a desktop web browser for anything finance (and it's Firefox on Linux, so thankfully that works for now).

pastage 1y ago
The phone will be used as MFA, and that will have requirements especially on Android versions. So it is going to be harder to escape it, it is darn comfortable using Android as a MFA. Many banks still use a custom device for MFA here but is is slowly going away. BankID in Sweden and similar in other European countries.
- PeterStuer 1y ago
  For now the custom issued 2FA is still an inconvenient option, but nearly everyone uses the phone for 2FA as it is so much faster.
homebrewer 1y ago
It's getting repetitive to come with the same message over and over and over again, but in many countries you can no longer interact with your bank through the web browser. The banks' applications are either required for 2FA, or are the only way to use remote banking at all. The last one applies in my country. You can of course go to the bank branch for every little financial operation, which is bad enough by itself for us living in cities, but is practically impossible for my relatives in the rural area, who would have to drive 100 km to the nearest bank branch, and then back just to move some money between two accounts. Even if you don't care for anyone else but your country, it will come to you also, I promise.
- fsflover 1y ago
  You should at least complain to your bank and government, support NGOs fighting for your freedom like https://edri.org https://edri.org, https:/eff.org, or equivalent in your country. Forcing you to use foreign megacorps for essential services should be illegal if not already.

PeterStuer 1y ago

Many banks are slowly phasing out their websites to go app only.

derwiki 1y ago
Which ones?
- kikokikokiko 1y ago
  every single Brazilian bank for instance
  - deleted 1y ago
    [deleted]
  - BlueTemplar 1y ago
    Brazil is screwed anyway from what I heard about WhatsApp being mandatory for daily life ?
    - homebrewer 1y ago
      Even though I very much dislike WhatsApp, it does not require having full control over "your" device, and does not make itself an arbiter of what you can or cannot install on "your" hardware. I can't see them changing this in the foreseeable future, major parts of their userbase run the cheapest phones one can buy, and they're much more interested in as much data as possible, so near 100% device coverage has to be important for them.
      - BlueTemplar 1y ago
        Last time I tried to use WhatsApp (in 2024), it was also basically unusable, because after I gave it the barest amount of information during installation (using its own dialog screens !), (in particular not willing to share my contacts), it regularly locked me out (IIRC as not a 'real' user).

deleted 1y ago

[deleted]

sfdlkj3jk342a 1y ago

It's too late for that. In many Asian countries, most of the banks have completely removed access via a browser.

vkou 1y ago

> What if we collectively decide to use the web alternatives for banking? So, like, legislate it? Prior art exists on this point.

tim1994 1y ago

Ain't gonna happen (unfortunately). Somehow people (outside of HN) seem to like to use apps for everything. EVERYTHING.

sushhtr 1y ago

Can anyone confirm that the situation regarding authentication in EU will change with the PSD3 directive ? As far as I read the directive will require authentication methods to individuals without smartphones. Anyone alrady working on this ?

prmoustache 1y ago
All EU banks provide an hardware device if you ask for it already.
- BlueTemplar 1y ago
  Not all. Mine was willing to downgrade me to SMS 2FA though.

matheusmoreira 1y ago

In my country banks have required users to install "security modules" to log into their accounts for decades now. Once upon a time I tried to crack one of these things open. I discovered they were literal device drivers running in kernel mode and I caught them intercepting every single network connection. Told me all I needed to know. They even have Linux versions: https://aur.archlinux.org/packages/warsaw https://aur.archlinux.org/packages/warsaw https://aur.archlinux.org/packages/warsaw-bin https://aur.archlinux.org/packages/warsaw-bin Who even knows what this malware does? I sure as hell don't want to find out. For the bank, things like "fraud prevention" override literally everything. There is no limit they wouldn't cross and there is no freedom they wouldn't trample in the pursuit of their goals.

yonatan8070 1y ago
Just... wow. People get so mad about kernel-level anti cheat in video games, but when your bank does it, I've never heard of it before. I sure am glad my bank doesn't do this for now.
- matheusmoreira 1y ago
  The video games industry and the copyright monopolists were just the first bosses. Now we're dealing with banks. One day we'll have to deal with governments. They think everything they do is justified and necessary. They've got a "legitimate" reason to do it so it's alright. Because total nonsense like fraud prevention is totally worth giving up our freedom for.