4 ms·

Some banks require app confirmation for PC-initiated transactions, using play integrity requiring apps. Cause security, you know.

SchemaLoad 1y ago
It's because it's way easier to install malware on PC than mobile. None of us are immune either. In recent times there has been malware distributed by common NPM packages as well as game mods. Every NPM package you install has the ability to steal your browser session tokens and the only thing stopping the attacker from actually logging in and spending your money is the fact it has to be confirmed on your phone.
- jojobas 1y ago
  Choosing between a risk of that and preinstalled non-removable malware in every phone? Tough one, I know.
- array_key_first 1y ago
  That doesn't require a bank approved app - we already have authentication mechanisms that are standardized. People do proprietary bullshit because they want to do proprietary bullshit. Anything else is made up.
koolala 1y ago
What kind of transactions require this? Normal bank transactions don't, right?
- jojobas 1y ago
  Transfer of more than a set amount between even your own accounts in different banks.
  - koolala 1y ago
    Between your own accounts is the main use-case because you typically can't transfer between different banks.
    - lmm 1y ago
      > you typically can't transfer between different banks WTF? What kind of shitty banking system are you using?
      - koolala 1y ago
        Wells Fargo said to do it I had to use Zelle.
        lmm 1y ago
        Wow. You guys really need better banking regulation.
        immibis 1y ago
        AFAIK Zelle is something US banks got together and set up on their own because the government didn't. So a Zelle transfer is the US equivalent of a SEPA transfer.
- brewdad 1y ago
  My brokerages require it every time I login from a computer. My bank will require it if it can't find a cookie from a previous login session. Occasionally, my bank will require it seemingly randomly since I usually log in at least once a week from my laptop yet every couple of months or so I have to reconfirm on the app or another secondary method.
  - koolala 1y ago
    What are the other secondary methods?
- lmm 1y ago
  Depends on the bank's policies. Currently it tends to be when you transfer to a new destination and/or above a certain amount. I could certainly imagine a bank requiring it for every PC-initiated transaction as and when they reach a point where most normie customers are using their app.
  - koolala 1y ago
    "Every PC-initiated transaction" doesn't make sense to me. What type are transactions are you talking about?
    - lmm 1y ago
      > What type are transactions are you talking about? Bank transfers and I guess direct debit authorisations (if your bank requires you to confirm those) and reauthorisation/confirmation of card payments that were blocked by the bank's fraud detection. I think those are the only kinds of transactions one would ever use a PC for? I mean for me most of my day-to-day transactions are me paying by debit card in a shop, but you can't do that on a PC in the first place; pretty much everything else I do on my PC.
      - koolala 1y ago
        Do you have to authorize those day-to-day transactions with your debit card on your phone every time?
        lmm 1y ago
        No. Only to unblock when they get blocked/flagged as fraud (tends to happen for large transactions like plane tickets or buying a bunch of furniture), and even then I currently have the option of authorizing via the web browser (and I think also via phone call). But sending a bank transfer is also a fairly common day-to-day transaction that I do a couple of times a month (and is the only way to pay for some government services like tax certificates short of visiting the tax office in person). Authorising a new direct debit happens occasionally (joined a gym, changed my utility provider, got a new credit card, that kind of thing).
- degamad 1y ago
  Fraud prevention on my primary transaction account requires 2FA for every transfer. The only supported 2FA is the bank's own dedicated 2FA app.
  - koolala 1y ago
    So if you buy something on Amazon with your debit card you have to authorize it?
drnick1 1y ago
I think it's time to look for a new bank.
- dotancohen 1y ago
  In my country we have a large religious community that eschews smartphones. Due to this no company or government agency requires a smartphone for service.
  - drnick1 1y ago
    This is a very good thing. I don't think many people here on HN reject technology, but sometimes no technology is better than one that is not controlled by the user.
    - veber-alex 1y ago
      No it isn't. They just use an SMS code instead which is not secure at all.
      - bandie91 1y ago
        choosing a wrong alternative does not make mandating spyphones good. why not distribute hw tokens for purposes like this? it has the least flaws IMO.
  - bandie91 1y ago
    would you mind reveal which community and country is this? maybe i can ask them to lobby in my area too...
    - dotancohen 1y ago
      It's the religious Jews in Israel.

SchemaLoad 1y ago

It's because it's way easier to install malware on PC than mobile. None of us are immune either. In recent times there has been malware distributed by common NPM packages as well as game mods. Every NPM package you install has the ability to steal your browser session tokens and the only thing stopping the attacker from actually logging in and spending your money is the fact it has to be confirmed on your phone.

jojobas 1y ago
Choosing between a risk of that and preinstalled non-removable malware in every phone? Tough one, I know.
array_key_first 1y ago
That doesn't require a bank approved app - we already have authentication mechanisms that are standardized. People do proprietary bullshit because they want to do proprietary bullshit. Anything else is made up.

koolala 1y ago

What kind of transactions require this? Normal bank transactions don't, right?

jojobas 1y ago
Transfer of more than a set amount between even your own accounts in different banks.
- koolala 1y ago
  Between your own accounts is the main use-case because you typically can't transfer between different banks.
  - lmm 1y ago
    > you typically can't transfer between different banks WTF? What kind of shitty banking system are you using?
    - koolala 1y ago
      Wells Fargo said to do it I had to use Zelle.
      - lmm 1y ago
        Wow. You guys really need better banking regulation.
      - immibis 1y ago
        AFAIK Zelle is something US banks got together and set up on their own because the government didn't. So a Zelle transfer is the US equivalent of a SEPA transfer.
brewdad 1y ago
My brokerages require it every time I login from a computer. My bank will require it if it can't find a cookie from a previous login session. Occasionally, my bank will require it seemingly randomly since I usually log in at least once a week from my laptop yet every couple of months or so I have to reconfirm on the app or another secondary method.
- koolala 1y ago
  What are the other secondary methods?
lmm 1y ago
Depends on the bank's policies. Currently it tends to be when you transfer to a new destination and/or above a certain amount. I could certainly imagine a bank requiring it for every PC-initiated transaction as and when they reach a point where most normie customers are using their app.
- koolala 1y ago
  "Every PC-initiated transaction" doesn't make sense to me. What type are transactions are you talking about?
  - lmm 1y ago
    > What type are transactions are you talking about? Bank transfers and I guess direct debit authorisations (if your bank requires you to confirm those) and reauthorisation/confirmation of card payments that were blocked by the bank's fraud detection. I think those are the only kinds of transactions one would ever use a PC for? I mean for me most of my day-to-day transactions are me paying by debit card in a shop, but you can't do that on a PC in the first place; pretty much everything else I do on my PC.
    - koolala 1y ago
      Do you have to authorize those day-to-day transactions with your debit card on your phone every time?
      - lmm 1y ago
        No. Only to unblock when they get blocked/flagged as fraud (tends to happen for large transactions like plane tickets or buying a bunch of furniture), and even then I currently have the option of authorizing via the web browser (and I think also via phone call). But sending a bank transfer is also a fairly common day-to-day transaction that I do a couple of times a month (and is the only way to pay for some government services like tax certificates short of visiting the tax office in person). Authorising a new direct debit happens occasionally (joined a gym, changed my utility provider, got a new credit card, that kind of thing).
degamad 1y ago
Fraud prevention on my primary transaction account requires 2FA for every transfer. The only supported 2FA is the bank's own dedicated 2FA app.
- koolala 1y ago
  So if you buy something on Amazon with your debit card you have to authorize it?

drnick1 1y ago

I think it's time to look for a new bank.

dotancohen 1y ago
In my country we have a large religious community that eschews smartphones. Due to this no company or government agency requires a smartphone for service.
- drnick1 1y ago
  This is a very good thing. I don't think many people here on HN reject technology, but sometimes no technology is better than one that is not controlled by the user.
  - veber-alex 1y ago
    No it isn't. They just use an SMS code instead which is not secure at all.
    - bandie91 1y ago
      choosing a wrong alternative does not make mandating spyphones good. why not distribute hw tokens for purposes like this? it has the least flaws IMO.
- bandie91 1y ago
  would you mind reveal which community and country is this? maybe i can ask them to lobby in my area too...
  - dotancohen 1y ago
    It's the religious Jews in Israel.