Comment by fuzzzerd
5 days ago
In my case, the app offers functionality that isn't available on the web version. So I resentfully use the app, but I'd prefer all features were available via the web instead.
5 days ago
In my case, the app offers functionality that isn't available on the web version. So I resentfully use the app, but I'd prefer all features were available via the web instead.
I’m with you, except that in this situation I resentfully forego the feature because I refuse to install apps.
Web banking means you need the card reader gadget as well for the authentication. The app uses secure features of the OS to aid authentication so you don't need to read the card. Web access on your phone still needs the card reader gadget.
Depends on where in the world you are, Norway for instance has not been using card chips for 2fa consumer auth for banking. Instead the 2fa has been a separate code generating gadget, and now also alternatively an app (which I do get the feeling the company that the banks set up handle auth for all of them are kinda pushing everyone into, but for now there thankfully is an option where you only need 1 online device with nothing more than a functioning browser).
Modern cards and phones support NFC, so you would only need a "gadget" (NFC reader) when using a PC that doesn't already have one, and a USB one is ~$20.
What this really needs is better browser support for NFC:
https://developer.mozilla.org/en-US/docs/Web/API/Web_NFC_API
But so let's do that then.
That isn't the kind NFC you think it is.
It's RFID communication with a smart card. The bank would have to transmit keys to your computer to be able to interface with it, which they probably won't want to do for security reasons.
1 reply →
It's not the NFC the bank is interested it, it the MFA provided by your phone PIN, fingerprint or face unlock.
When you open the app on your phone, the phone probably needed to be unlocked first, though not everyone sets a PIN or biometric lock on their phone.
Then you will be prompted for a separate PIN or your fingerprint within the banking app. This provides a stronger signal to the bank that you are the legitimate account holder. If your phone is lost or stolen, the chances of someone else being able to authenticate to your banking app are considerably reduced.
With the web app, people will often save their bank website login credentials in the browser. So now someone nefarious only needs to access the unlocked computer or phone the go to the bank's website to gain unauthorised by still authenticated access to the customer's accounts.
Yes, there are now laptops and tablets with biometric authentication, so the potential is there for adding biometric authentication for banking website. However, when you look at the demographics of banking app vs website use, a strong majority of Millennials and Gen-Z do all their banking via the phone app. Gen-X also slightly favour the phone app whereas Boomers strongly prefer the website. So banks focus their development efforts where the majority of users are.
> When you open the app on your phone, the phone probably needed to be unlocked first, though not everyone sets a PIN or biometric lock on their phone.
The same is true for PCs. They've supported that sort of thing for decades, and it's optional for both the phone and the PC.
On top of that, a phone that people carry around everywhere is dramatically more likely to be lost or stolen than a desktop PC that never leaves their house.
> With the web app, people will often save their bank website login credentials in the browser.
If the bank actually cares about this then there are various ways to disable or impede it.
> However, when you look at the demographics of banking app vs website use
This is just the thing where you make something worse so fewer people use it and then use that as an excuse to keep making it worse. Nobody needs an app that could have been a web page, people use them because it's what get shoved down their throat if they don't go out of their way to do something else.
meanwhile in my case the app offers functionality that isn't available on the web version while simultaneously requiring the web version for some of the things