Comment by codedokode
5 days ago
Why not just use a web app from laptop at home? Why do you even need an app on your phone? So that you can urgently transfer money to some scammers you met in the street?
I do not have any banking apps, and I log into a bank account maybe once in month or less often.
Agreed that a website should be fine, but (Dutch) banks require the app as a second factor to log into the website. Fido2 hardware tokens could replace the bullshit requirement of "choose Apple or Google to be your overlord in order to use our service".
Ehm, no. They don’t all do at least. For one, Rabobank does not require it. You can use the app to authorize in the browser. But for big transfers you still need their Rabo Scanner (which you get the first one of for free).
It's being phased in due to regulations. They're allowed to offer insecure SMS 2FA to confirm transfers, etc. as an alternative but are supposed to move away from it.
We use SMS OTP as a second factor. Although banks of course want to save some cents and use push notifications for those who has a mobile app.
The EU has regulations requiring banks to move to an app with device and app integrity checks. SMS 2FA is temporarily permitted for backwards compatibility but is explicitly considered a legacy approach that's being phased out due to being insecure.
SMS OTP is not very secure relative to a push notification to an app
The same functionality available through a web app on a laptop is available on a GrapheneOS phone through the same web app. Banks increasingly limit features such as sending transfers or depositing cheques to their iOS and Android apps. There are government regulations and industry standards being put in place which require using an app with device and app integrity checks to approve transfers. The EU has these kinds of regulations but temporarily allowed using insecure SMS 2FA for confirmation instead.
> Banks increasingly limit features such as sending transfers or depositing cheques to their iOS and Android apps.
Not only these features. Viewing PIN, enabling bank cards for internet purchases, enabling/disabling cards.
Unfortunately the only way I can spend directly from my work-sponsored FSA account is if I download their app. I haven't, since I can still just submit receipts, but they won't send you a physical card.
I think EU regulation kind of force the banks into app usage as 2nd factor
Yes, they're required to move to apps with device and app integrity checks. SMS 2FA is temporarily permitted for the transition period.
A lot of banks are dropping support for making transfers from their regular webapp. AFAIK, in some countries a total of zero banks support this.
In Russia, all banks I tried, are usable via web app (because smartphone apps live only 1-2 months before they are detected and removed from app stores). The disadvantage of a web app is that it is not always-on, doesn't allow tracking users are well as a real app, and cannot display advertisement notifications.
EU regulations require banks to require confirmation in an app with device and app integrity verification. They don't specify what that means but they have to do it. SMS 2FA is temporarily allowed for the transition period.
Apps are not required to use the Play Integrity API or a similar attestation API. The details of what they're required to do are unspecified and open ended. Many are interpreting it as meaning they use the Play Integrity API and we have to convince each one to permit GrapheneOS via the Android attestation API. It's not good and we would greatly prefer if this wasn't happening even if we were managing to convince most apps to permit GrapheneOS.
I'm don't see "allow GrapheneOS" as a great difference: the bank is still only permitting transactions on devices controlled by a third party and not by the owner. I don't want to change the third party that controls the device. I want to use my own device.