5 ms·
Hardware tokens are not allowed in Europe to authorize certain operations such as bank transfers: you need a device that can show the operation you are about to
by fph 9mo ago
Hardware tokens are not allowed in Europe to authorize certain operations such as bank transfers: you need a device that can show the operation you are about to authorize ("enter 123456 to confirm your payment of 99.99 € to Pornhub"). And that essentially means using a phone.
- layer8 9mo agoMaybe it’s country-specific, but most banks I know support a card reader or photoTAN device. You don’t need to use a phone.
- fph 9mo agoI don't think card readers can display payment information, can they? And I have no idea why, but no bank offers photoTAN devices in my country. They seem like an interesting concept, even though I imagine the underlying hardware isn't far from that of a phone, in the end.
- layer8 9mo agoThe card readers have an LCD display that shows the information.
- fph 9mo agoHow do they get this information in the first place, though? Do they have a QR code reader?
- sdl 9mo agoYes, in that case it's often called Photo-TAN or QR-TAN. See https://en.wikipedia.org/wiki/Transaction_authentication_number#ChipTAN_/_Sm@rt-TAN_/_CardTAN https://en.wikipedia.org/wiki/Transaction_authentication_num... Previously there were also so called "flicker TAN" approaches: https://de.wikipedia.org/wiki/Transaktionsnummer#chipTAN_comfort_bzw._SmartTAN_optic_(Flickering) https://de.wikipedia.org/wiki/Transaktionsnummer#chipTAN_com...
- sdl 9mo agoGerman VR Banken: https://genostore.de/Banking/Kartenlesegeraete/ https://genostore.de/Banking/Kartenlesegeraete/ Sparkassen: https://www.sparkassen-shop.de/home/shop/tan-generatoren,375/ https://www.sparkassen-shop.de/home/shop/tan-generatoren,375...
- WhyNotHugo 9mo agoI’ve seen dedicated hardware devices which scan a QR-like code and show this in a little screen of their own. The bank provides them and does not require any app. I only know of a single bank using this.
- SkySkimmer 9mo ago>I only know of a single bank using this. If it's not Crédit Mutuel then you now know of a second bank using this method.
- rzr 9mo agoI am interested too, my fallback bank trapped me (or my courage to resist), the fallback of fallback would be crypto but i am not sure i want to depend on this too... Meanwhile, the last hope is that people will use more cash (if the digital world is too hostile, oh wait it is!)
- rsync 9mo agoIs this true? The old, standard RSA number generator token key ring device is not permitted in Europe for authorizing bank actions ?
- fph 9mo agoPrecisely. You can use and old-style hardware token that only generates numbers to log in, but not to authorize an operation such as a money transfer. The requirement is called "dynamic linking" (the 2FA code must be tied to the specific transaction) and the relevant regulation is PSD2.
- miahi 9mo agoThere are "simple" hardware tokens that allow for that - you have to enter the amount and part of the destination IBAN and they generate a 2FA number based on that + probably the same number generator it uses for logins.
- finaard 9mo agoI'm in Europe, and some of my banks still operate with a token just showing numbers, while others use devices with QR code readers and a colour display which then can show transaction details. They don't really like you using that and keep annoying you to stop doing that, but I don't think they'll fully get rid of that - those are filling some accessibility niches as well.
- guax 9mo agoI am in europe and my bank issued me a hardware token I still need to use from time to time.