Hacker News Reader

Comment by dvdkhlng | Hacker News Reader

AFAICS, no, they don't. If you don't install the bank's app, you are usually offered to use a stand-alone hardware TAN generator. I currently have 4 TAN generators for different bank accounts (because everybody seeems to use a different protocol).

On the positive side, a stand-alone air-gapped TAN generator feels much saver than using a (possibly back-doored) smart-phone to do on-line banking.

View on HN

For people outside Germany, here's what a TAN generator looks like: https://www.pcdirekt.de/hardware/tan-generator/

Obviously I can't speak for every country and every bank, but at least in two countries and with two banks they are trying really hard to get me off the hardware tokens and onto mobile phones.

They have done all kinds of dark patterns, for example they update the website (which eventually becomes a mandatory update), but that requires relinquishing the hardware token, or they update their mobile app, and if you even try to log-in into the new app they automatically cancel your token, etc.

When my token's battery died, they didn't want to give me a new one. They said they don't offer the service anymore. Only after escalating N times and explaining that I need a hardware token because their SMS-based 2FA didn't work internationally they gave me a new token. Suddenly it wasn't discontinued anymore. Now they moved off SMS-based 2FA to some mobile app, so I suspect next time I need a token I won't be able to get it.

Make no mistake, enjoy your TAN generator while you can, because you will not be able to enjoy it for long.

In the country I live in right now, the only way to get a proof for your COVID-19 vaccination is if you "voluntarily" enroll into some phone-based authentication scheme with your government that requires a modern, non-jailbroken iOS or Android device.

Yes, exactly. Maybe you can protect yourself (a bit) by having two phones. One for browsing and communication and one to get official (banking/vaccination/etc) stuff done.

In germany (and I'd assume standardized throughout europe) COVID vaccination digital certificate is just that: a digitally signed certificate (encoding your name+vaccination meta-info) passed around via QR code. While you can use an App to read and present it, just having a paper-copy of the QR code (plus some ID document proving that the name on the certificate matches your person) should be enough to prove your vaccination status.

There is nowhere to get a paper copy from in my country. At least not without going through insurmountable hoops. I tried.

You have to log-in to a government website, and you do it either through a mobile phone registered with the government, or with a smartcard and a proprietary Java application. Pick your poison. (And they don't want to issue new smartcards either.)

I'm not in Germany, but I am currently moving banks because the only way to do online banking is to have an Android or Apple phone, either for 2FA or for mobile banking. They don't have hardware generators. I currently have an old Windows phone (unsupported) and a Pinephone (unsupported), so no online banking for me.

This is so weird to me. I'm over here in the US using a website with a regular old password, no 2FA or anything. Same thing at multiple institutions.

I've run into a few that require 2FA - either SMS or email, your choice.

There is a new EU regulation that requires certain security considerations. Sadly, all banks decided that the best way to implement those was to develop a proprietary solution for themselves and completely avoid anything even close to being standardized.

What bothers me is they all had 2FA in the form of certificates or SMS auth, and most of them moved off of that to some other solution (current bank has 3rd party login which I can do with a cert, the old bank only has an app). What's wrong with cert auth? It can't be less secure than an android app.

Some banks offer it (usually those with higher fees), but unless you count every separate Sparkasse and VR as their own Bank (for non-Germans: It’s similar-ish to a franchising system), I wouldn’t say "usually".

Reply on news.ycombinator.com