Hacker News Reader

Comment by c7DJTLrn | Hacker News Reader

The only thing I'd struggle to lose is a map (Google Maps/Apple Maps). For me, it's essential if I'm going somewhere unfamiliar.

View on HN

Doesn't good old https://maps.google.com or https://osm.org work on phones without apps?

I don't know, would it? It requires fairly modern browser features that I don't remember the old school phones' browsers having.

The mobile web interface of Google Maps is hideous and unusable. I had to use it from time to time, when OSM didn't have the data I needed, and I regretted every second of it.

It's by design so you use the app

Most online banking sites in Germany require a phone nowadays, some even one that passes Google safety net for Android phones.

You mean a phone to receive a text for MFA? "Most" can't be more than that.

However there are a couple of new "Fintech" banks in the UK that are mobile app only. No website and I assume very difficult to get anyone on the phone. That seems crazy to me. Access to your bank is at the mercy of Google/Apple.

They probably require something like SmartID, which means that you need to have a smartphone that's not rooted. Ie can't even use LineageOS.

Rooted is unrelated, some apps require it, others don’t. But several require their proprietary app to access the online banking website from your computer.

Rooted is related in that some apps will refuse to work, or will disable features if they detect that the phone is rooted.

Until SafetyNet is improved you can still hide you're rooted via MagiskHide.

I wrote that, yes. But my comment was about the broader situation and not just about the apps requiring root.

Some banks in Germany support chipTAN which doesn't require a phone. You can find a list of banks supporting chipTAN here: https://www.kostenloser-girokonto-vergleich.de/diese-banken-...

That list is outdated. I was doubtful DKB (which you can’t even use with rooted Android devices, I had to cancel my account via customer support because they decided to cut me off with a minor update) allows chipTAN, and the latest comment is that they stopped supporting it.

I'm regularly using chipTAN with a stand-alone TAN generator (similar to [1], based on optical flicker-code) for a DKB account. No problems so far.

Deutsche bank uses PhotoTAN, which supports hardware TAN generators [2].

Some banks use different but similar TAN generators (e.g. SecurePlus [3]), and I also witnessed Postbank accounts operated with USB-based TAN generators [4] called "BestSign".

[1] https://www.voelkner.de/products/476429/REINER-SCT-tanJack-o...

[2] https://genostore.de/db/phototan-lesegeraet/92/phototan-lese...

[3] https://cb.kobilshop.com/secureplus-generator/1/secureplus-g... securePlus Generator

[4] https://www.seal-one.com/devices.en#DiVc3100KLink BestSign

You are right and I stand corrected

AFAICS, no, they don't. If you don't install the bank's app, you are usually offered to use a stand-alone hardware TAN generator. I currently have 4 TAN generators for different bank accounts (because everybody seeems to use a different protocol).

On the positive side, a stand-alone air-gapped TAN generator feels much saver than using a (possibly back-doored) smart-phone to do on-line banking.

Obviously I can't speak for every country and every bank, but at least in two countries and with two banks they are trying really hard to get me off the hardware tokens and onto mobile phones.

They have done all kinds of dark patterns, for example they update the website (which eventually becomes a mandatory update), but that requires relinquishing the hardware token, or they update their mobile app, and if you even try to log-in into the new app they automatically cancel your token, etc.

When my token's battery died, they didn't want to give me a new one. They said they don't offer the service anymore. Only after escalating N times and explaining that I need a hardware token because their SMS-based 2FA didn't work internationally they gave me a new token. Suddenly it wasn't discontinued anymore. Now they moved off SMS-based 2FA to some mobile app, so I suspect next time I need a token I won't be able to get it.

Make no mistake, enjoy your TAN generator while you can, because you will not be able to enjoy it for long.

In the country I live in right now, the only way to get a proof for your COVID-19 vaccination is if you "voluntarily" enroll into some phone-based authentication scheme with your government that requires a modern, non-jailbroken iOS or Android device.

In germany (and I'd assume standardized throughout europe) COVID vaccination digital certificate is just that: a digitally signed certificate (encoding your name+vaccination meta-info) passed around via QR code. While you can use an App to read and present it, just having a paper-copy of the QR code (plus some ID document proving that the name on the certificate matches your person) should be enough to prove your vaccination status.

There is nowhere to get a paper copy from in my country. At least not without going through insurmountable hoops. I tried.

You have to log-in to a government website, and you do it either through a mobile phone registered with the government, or with a smartcard and a proprietary Java application. Pick your poison. (And they don't want to issue new smartcards either.)

Yes, exactly. Maybe you can protect yourself (a bit) by having two phones. One for browsing and communication and one to get official (banking/vaccination/etc) stuff done.

I'm not in Germany, but I am currently moving banks because the only way to do online banking is to have an Android or Apple phone, either for 2FA or for mobile banking. They don't have hardware generators. I currently have an old Windows phone (unsupported) and a Pinephone (unsupported), so no online banking for me.

This is so weird to me. I'm over here in the US using a website with a regular old password, no 2FA or anything. Same thing at multiple institutions.

I've run into a few that require 2FA - either SMS or email, your choice.

There is a new EU regulation that requires certain security considerations. Sadly, all banks decided that the best way to implement those was to develop a proprietary solution for themselves and completely avoid anything even close to being standardized.

What bothers me is they all had 2FA in the form of certificates or SMS auth, and most of them moved off of that to some other solution (current bank has 3rd party login which I can do with a cert, the old bank only has an app). What's wrong with cert auth? It can't be less secure than an android app.

Some banks offer it (usually those with higher fees), but unless you count every separate Sparkasse and VR as their own Bank (for non-Germans: It’s similar-ish to a franchising system), I wouldn’t say "usually".

For people outside Germany, here's what a TAN generator looks like: https://www.pcdirekt.de/hardware/tan-generator/

Mine has it as an option, but it also supports this[1] external tan generator. I use it since I do not understand how a single device that could hold all the data needed for online banking can be considered 2 factor, when its 1 factor at best.

[1]https://www.mediamarkt.de/de/product/_reinersct-tanjack%C2%A...

I just picked up a tom-tom on ebay for $30.00, I forgot how awesome having a dedicated GPS can be. No hot phone, no worries about data connection.

The feature phones do have google maps, but from what I've read they all take some time to acquire a lock (could be a software issue?)

Probably hardware. GPS either requires a bootstrap starting point or it has to completely solve the equations to calculate the location (slow!).

Expensive phones triangulate via towers (fast!) and use that to bootstrap the GPS unit. Some GPS units don’t support that bootstrapping and are, thus, slower.

My 10 year old Garmin still works and I can get updated maps on it if I ever need it.

Just take a mobile device and avoid matching it to any identity, if - like many - you have needed pocket computing power since forever and since forever you have been a private individual.

That's not really possible. iPhones require an iCloud account which even if not directly linked to you, serves as a pool of information that Apple can gather about you and work out your identity from. The second you switch on your phone, it connects to several cell towers and enables your position to be triangulated. As you move around between work, home, the shops, it's constantly informing the providers of your location. Even if you switch SIMs regularly, your device's IMSI number is static and serves as a unique fingerprint. Conveniently, spoofing IMSI numbers is illegal. Guess why.

Theoretically it might be possible to combat cell tower triangulation by having the modem only respond to one tower at a time and insert artificial latency to make it harder to work out your distance. But, another convenient fact: cell modems are all closed source, proprietary black boxes. They also have DMA (Direct Memory Access) to your phone.

Perhaps I should be wearing a tinfoil hat but these don't seem like coincidences to me. They seem like intentional measures to weaponise a tool in our everyday lives.

> iPhones require an iCloud account

Nope. I have several dev devices. None of which have an iCloud account setup.

Didn’t do anything special; just skipped it at setup.

I think a good balance between usability and privacy is to use LineageOS with MicroG (an open implementation of GApps APIs) or something like Sailfish OS.

Reply on news.ycombinator.com