Hacker News Reader

Comment by swiley | Hacker News Reader

I've heard this a couple of times and it seems a bit strange. My bank is entirely online and has a very nice app (USAA) but there's absolutely nothing that can be done in the app and can't be done with their webpage.

Is this something that happens often in eg Europe?

View on HN

The login shortcuts make it somewhat worthwhile. Many of the finance apps have a 'quick view' function and also allow for faster logins via specific PINs and such. It is a convenience to quickly check balances or recent transactions while using the phone.

There is a European banking regulation mandating 2FA. Apps are starting to be mandatory because they generate the OTP or authorize access: start logging in in the browser on the computer and authorize the access with a fingerprint in the app.

https://en.wikipedia.org/wiki/Strong_customer_authentication

I would say the authentication app is becoming mandatory, not the banking apps.

It is perfectly possible to use the website but authorize with the app. Which I admit does not solve the problem at hand

This is what I usually do: login on the computer and authorize on the app with a fingerprint or a PIN. It depends on the bank and doesn't require signin in into the home banking, only opening the app. The access to home banking in the app is always by fingerprint.

If the app is on the same device as the OTP, that's not really 2FA, since the device has both factors on it, making the device 1 factor. Maybe 1.5 factor since there are ways to steal a password without getting access to the device. Anyway the computer or a dongle can be the OTP device just as well as the phone can.

It is two factor still. For example, if you need to give a OTP through sms after puting the credentials. It is possible someone stole the credentials and entered them on another device, but he also has to put the OTP sent through SMS to prove he is also in possesion of the phone number and thus makes the authentication a two factor. If you think both authentications on the same device is one factor, both authentications in the same room is also one factor, going by the same logic - an attacker will have you and everything needed to force his way into your bank account together, then he only needs a big baseball bat to do the job.

Many banks allow you to request a physical device to generate the tokens, so a smartphone isn't required.

> but there's absolutely nothing that can be done in the app and can't be done with their webpage.

I have never gotten the check deposit tool to work on the website. I know it is nonexistent in the mobile site. So for me, the only way to deposit a check (with USAA) is to either mail it or use the Android app.

Wow I forgot about check depositing, the last time I did that I still had an account with a bank with physical branches and didn't bother with "online banking."

Unfortunately this is the direction. Most banks here now require the app even for two factor to access their website. I consider it a lost battle.

There's more examples, but the main feature I'd lose is contactless pay with my phone. Which I could live without, but it's such a nice feature that I use multiple times a day that I'm not sure what it would take to get me to give it up.

I think that the US doesn't use mobile payment a lot, so it might not be obvious (if you're in the US, that is)

Reply on news.ycombinator.com