Comment by exceptione
5 days ago
Agreed that a website should be fine, but (Dutch) banks require the app as a second factor to log into the website. Fido2 hardware tokens could replace the bullshit requirement of "choose Apple or Google to be your overlord in order to use our service".
Ehm, no. They don’t all do at least. For one, Rabobank does not require it. You can use the app to authorize in the browser. But for big transfers you still need their Rabo Scanner (which you get the first one of for free).
It's being phased in due to regulations. They're allowed to offer insecure SMS 2FA to confirm transfers, etc. as an alternative but are supposed to move away from it.
We use SMS OTP as a second factor. Although banks of course want to save some cents and use push notifications for those who has a mobile app.
The EU has regulations requiring banks to move to an app with device and app integrity checks. SMS 2FA is temporarily permitted for backwards compatibility but is explicitly considered a legacy approach that's being phased out due to being insecure.
SMS OTP is not very secure relative to a push notification to an app