5 ms·

Webapps solve this completely. You login to a service as we have been doing forever. And the control is still on their side when you use a webapp. Almost every

Webapps solve this completely. You login to a service as we have been doing forever. And the control is still on their side when you use a webapp. Almost every single app that is on my phone can be a webapp.

ulrikrasmussen 1y ago
This works only as long as the webapp allows you to log in using a username/password and/or 2FA which is not tied to a smartphone app. More and more countries are moving to digital identity solutions, and while many of them offer hardware tokens as alternatives to apps, the future looks like one where smartphone apps will be only option.
- ecef9-8c0f-4374 1y ago
  Banking websites will tell you that you need 2FA. Of course you need to use not just any 2FA you need to use their app and of course you don't need a 2FA if you use the app directly for banking. My companys equity app does not even want to run on lineageos. At the moment it looks like a 2 phone will be necessary at some point.
  - ubertaco 1y ago
    Is there anything preventing use of something like Keepass vaults as your 2FA solution?
    - dns_snek 1y ago
      Yes, the fact that these 2FA systems aren't based on time-based one time passwords you're probably thinking of. It's a push notification that you need to open and approve in the official app.
    - Macha 1y ago
      The 2FA is not TOTP, it’s push notifications to the bank’s proprietary app
  - ulrikrasmussen 1y ago
    For now, my banking app actually runs on GrapheneOS. My digital identity app that it requires to log in does not, but luckily my government also offers an NFC chip that I can just scan instead. Two phones is such an unsatisfactory solution because it will be too impractical, too expensive, or both, for the vast majority of people.
  - pndy 1y ago
    The revised Payment Services Directive (PSD2) in EU describes standards of strong authentication and for the end user it means that mostly the bank's mobile app is being used as 2FA for logins and operations within the account I'm not sure if physical tokens are being used anywhere but if they are, that's rather rare nowadays. It may be an option reserved in bigger banks or for business customers - I can see one of banks in my country offers it for a request and not by default. Edit: it seems it's a feature for business indeed and banks opted for Cronto system - https://www.onespan.com/products/transaction-signing/cronto https://www.onespan.com/products/transaction-signing/cronto
TeMPOraL 1y ago
Websites as platform can't solve a problem that's social in nature - that it's allowed and accepted for organizations to have such excessive, invasive levels of control. The parties I accuse of driving this problem didn't suddenly go rogue when smartphones happened. They always wanted this level of control (and much more) - they just couldn't get it until relevant technologies matured enough. I'm not speculating here - we have actual empirical evidence to confirm this. A clear example is that there are several countries that, unlike the US and most of Europe, went all-in on Internet banking back before smartphones. Web limitations and conventions didn't stop them from doing the same thing everyone is doing with the phones now - the banks there just force customers to install malware on their computers, so they can do some remote attestation and KYC (and totally no marketing data collection) on their PCs. Most of the West never had this because of the inverse of leapfrogging phenomenon - big, developed economies had too fast progress and at the same time too much inertia to fully adopt a pre-smartphone solution nation-wide.
- vbezhenar 1y ago
  My bank had website which I can log in and just use. It does not force me to install anything. I need to type username, password and SMS code, that's about it.
  - TeMPOraL 1y ago
    Because your bank isn't even trying to be secure, relative to what's considered industry standard. Be grateful while it lasts.
    - candiddevmike 1y ago
      Why do you think their bank "isn't even trying to be secure"?
      - TeMPOraL 1y ago
        Because SMS is not considered a secure 2FA mechanism anymore, and hasn't been for a while. If that's the default for that bank, and not GP going out of their way to pick a legacy access path, then they're about a decade behind what's considered industry standard -- which today is querying a second factor not just per login, but also per important operations (money transfers, dispositions, changes in settings), with the second factor being by default a smartphone with hardware and software integrity verified via remote attestation.
kube-system 1y ago
But, it doesn't. The browser is unsupported for many of the above-mentioned applications.
- jayd16 1y ago
  Can I get an example of a single one that can't be found on the web?
  - kube-system 1y ago
    Netflix? Telegram's push 2FA? Any mobile wallet application? The vast majority of dating apps? Any of the app-only social networks? Basically all keyless entry applications?
    - jayd16 1y ago
      All functionality found on the web.
      - kube-system 1y ago
        Have you tried? * Netflix does not load in a mobile browser, it directs you to download their app. * web.telegram.org sends a 2FA push notification to their app * Apple wallet/ Android wallet do not have web apps * Popular dating apps, e.g. Hinge do not have web apps * Some social network apps, e.g. BeReal do not have web apps. Many others have reduced features. * I have never seen a keyless entry app that supports the web, at least not from a mainstream manufacturer. Can you name a single browser app that can do NFC payments in the US?
        lanfeust6 1y ago
        Firefox supports Netflix web app. It prompts you to install the Widevine plugin.
    - krzyk 1y ago
      I use Netflix web version on my linux desktop all the time.
kuhsaft 1y ago
Being a web app doesn’t mean shit. We already have DRM encrypted web content where the consuming device requires some attestation to decode. I.e. Widevine.
t_mann 1y ago
They're working hard on shutting that down as well with Passkeys. It's only a matter of time until the only way to log in will be through de-facto proprietary apps.

ulrikrasmussen 1y ago

This works only as long as the webapp allows you to log in using a username/password and/or 2FA which is not tied to a smartphone app. More and more countries are moving to digital identity solutions, and while many of them offer hardware tokens as alternatives to apps, the future looks like one where smartphone apps will be only option.

ecef9-8c0f-4374 1y ago
Banking websites will tell you that you need 2FA. Of course you need to use not just any 2FA you need to use their app and of course you don't need a 2FA if you use the app directly for banking. My companys equity app does not even want to run on lineageos. At the moment it looks like a 2 phone will be necessary at some point.
- ubertaco 1y ago
  Is there anything preventing use of something like Keepass vaults as your 2FA solution?
  - dns_snek 1y ago
    Yes, the fact that these 2FA systems aren't based on time-based one time passwords you're probably thinking of. It's a push notification that you need to open and approve in the official app.
  - Macha 1y ago
    The 2FA is not TOTP, it’s push notifications to the bank’s proprietary app
- ulrikrasmussen 1y ago
  For now, my banking app actually runs on GrapheneOS. My digital identity app that it requires to log in does not, but luckily my government also offers an NFC chip that I can just scan instead. Two phones is such an unsatisfactory solution because it will be too impractical, too expensive, or both, for the vast majority of people.
- pndy 1y ago
  The revised Payment Services Directive (PSD2) in EU describes standards of strong authentication and for the end user it means that mostly the bank's mobile app is being used as 2FA for logins and operations within the account I'm not sure if physical tokens are being used anywhere but if they are, that's rather rare nowadays. It may be an option reserved in bigger banks or for business customers - I can see one of banks in my country offers it for a request and not by default. Edit: it seems it's a feature for business indeed and banks opted for Cronto system - https://www.onespan.com/products/transaction-signing/cronto https://www.onespan.com/products/transaction-signing/cronto

TeMPOraL 1y ago

Websites as platform can't solve a problem that's social in nature - that it's allowed and accepted for organizations to have such excessive, invasive levels of control. The parties I accuse of driving this problem didn't suddenly go rogue when smartphones happened. They always wanted this level of control (and much more) - they just couldn't get it until relevant technologies matured enough. I'm not speculating here - we have actual empirical evidence to confirm this. A clear example is that there are several countries that, unlike the US and most of Europe, went all-in on Internet banking back before smartphones. Web limitations and conventions didn't stop them from doing the same thing everyone is doing with the phones now - the banks there just force customers to install malware on their computers, so they can do some remote attestation and KYC (and totally no marketing data collection) on their PCs. Most of the West never had this because of the inverse of leapfrogging phenomenon - big, developed economies had too fast progress and at the same time too much inertia to fully adopt a pre-smartphone solution nation-wide.

vbezhenar 1y ago
My bank had website which I can log in and just use. It does not force me to install anything. I need to type username, password and SMS code, that's about it.
- TeMPOraL 1y ago
  Because your bank isn't even trying to be secure, relative to what's considered industry standard. Be grateful while it lasts.
  - candiddevmike 1y ago
    Why do you think their bank "isn't even trying to be secure"?
    - TeMPOraL 1y ago
      Because SMS is not considered a secure 2FA mechanism anymore, and hasn't been for a while. If that's the default for that bank, and not GP going out of their way to pick a legacy access path, then they're about a decade behind what's considered industry standard -- which today is querying a second factor not just per login, but also per important operations (money transfers, dispositions, changes in settings), with the second factor being by default a smartphone with hardware and software integrity verified via remote attestation.

kube-system 1y ago

But, it doesn't. The browser is unsupported for many of the above-mentioned applications.

jayd16 1y ago
Can I get an example of a single one that can't be found on the web?
- kube-system 1y ago
  Netflix? Telegram's push 2FA? Any mobile wallet application? The vast majority of dating apps? Any of the app-only social networks? Basically all keyless entry applications?
  - jayd16 1y ago
    All functionality found on the web.
    - kube-system 1y ago
      Have you tried? * Netflix does not load in a mobile browser, it directs you to download their app. * web.telegram.org sends a 2FA push notification to their app * Apple wallet/ Android wallet do not have web apps * Popular dating apps, e.g. Hinge do not have web apps * Some social network apps, e.g. BeReal do not have web apps. Many others have reduced features. * I have never seen a keyless entry app that supports the web, at least not from a mainstream manufacturer. Can you name a single browser app that can do NFC payments in the US?
      - lanfeust6 1y ago
        Firefox supports Netflix web app. It prompts you to install the Widevine plugin.
  - krzyk 1y ago
    I use Netflix web version on my linux desktop all the time.

kuhsaft 1y ago

Being a web app doesn’t mean shit. We already have DRM encrypted web content where the consuming device requires some attestation to decode. I.e. Widevine.

t_mann 1y ago

They're working hard on shutting that down as well with Passkeys. It's only a matter of time until the only way to log in will be through de-facto proprietary apps.