4 ms·
Why don't banks just make desktop computer applications?
by abdullahkhalids 9mo ago
Why don't banks just make desktop computer applications?
- Aspos 9mo agoPractically impossible to store secrets in a desktop app too. Besides, customers would not willing to install a desktop app. And those who would, will require support.
- mike_hearn 9mo agoPC platforms don't have remote attestation infrastructure working.
- elric 9mo agoAnd surprisingly I can pay securely using my PC, fully rooted, on FOSS software. Hardware tokens have been a thing for decades. There are more second (or third) factor authentication and signing solutions than I can enumerate. Do peope get defrauded using online banking? Sure. But usually not in a way that would be stopped by secure attestation.
- Magnusmaster 9mo agoMost banks don't know hardware tokens are a thing. They want everyone to use their app.
- elric 9mo agoIs this yet more evidence of how utterly broken US banks are? Assuming you are referring to US banks. For the past 20 or so years, every bank I've been with in Belgium has provided me with one of three types of hardware token: 1. An OTP token that's just a screen that displays a new 6 digit token every couple of seconds (haven't seen one of these in a few years now). This was used to supplement username/password on login and to verify every bank transfer. 2. A token with a screen and a display, which generates OTPs based on input. E.g. for a payment the bank would tell me to enter the amount + the last N digits of the bank account, the token then generates an OTP, which I can use to confirm the payment. That's what 2 of my 3 banks currently use. They have separate modes for logging in, for signing bank transfers, for signing 3D Secure online payments, etc. 3. A card reader where where I just slot in my card. I can then log in or sign payments using the card's chip & pin. This is what my third bank uses. There are a couple of variants on this, such as models which connect with USB and models which can read QR codes from your screen so you don't have to tap in anything except for your PIN.
- mike_hearn 9mo agoThe hardware token is itself a form of remote attestation. The reason you need extra hardware is because the PC can't do it.
- deleted 9mo ago[deleted]
- elric 9mo agoThey used to, and some still kind of do, but no longer for consumers.