Comment by cowlevel
8 days ago
Has to be a significant majority or else they'll just turn the other methods off.
I don't have the choice to use a bank card online without 2FA - it's mandated. I can either use one of the options provided or I will go to my bank in person and close my account. Those are the possibilities. Nothing else.
An uncompromising minority has surprising power. See Nassim Taleb's idea of assymetric minority rule.
Passkeys are only one kind of 2FA.
Yes, banks are particularly bad at this because their threat model is strong.
My bank required installing an authenticator, but apparently recently they've allowed SMS based 2FA. It seems users complained/resisted and they had to accommodate them. Maybe you should give feedback to your bank. Be the uncompromising minority.
I think 2FA is fine and a good idea, but I agree with the author that passkeys seem fraught as designed.
TOTP is fine.
As somebody that’s had to deal with US banks and their bizarre “authentication” schemes: I wish.
Many would actually rather you close their account with them than them making the tiniest compromise or offering any alternative to their SOP at all. That SOP strongly assumes things like “all customers have a mobile phone plan with the big three carriers”, “all customers own property or at least have car insurance” (that’s already their authentication fallback flow!) etc.
Changing banks is incredibly annoying but this might be a reason to consider it.
I have also faced this issue with banks and their frustrating authentication issues. Not to mention proprietary app requirements.