Hacker News Reader

Comment by southernplaces7 | Hacker News Reader

Oh for god's sake it's not really that bad. A couple years ago I accidentally, absolutely shattered my smartphone one day and after a couple days without one while shopping around, I decided "why the hell not? let's see how long you can go without". Then spent an entire year with nothing but an old tiny Nokia dumb-as-bricks phone until some new work made a smartphone unavoidable again. You miss a few things sure, but enough of the silly modern drama.

Edit. For financial transactions, for all the talk among many here about not letting BigTech take over your personal life, it would be nice to see more effort to you know, actually apply that to the basics, such as by not utterly depending on a phone and a couple of mega payment processing tech monsters like Apple and Google to pay for basic shit that could be handled through fairly simple alternatives. a little inconvenience for the sake of a more fundamental point rarely kills.

View on HN

Finance and 2FA are effectively corporate backdoors to finally and completely lock down end-user devices and rent them out - same thing media companies tried to for the sake of DRM, but "preventing piracy" doesn't elicit the same kind of cooperation than "2FA makes you more secure" and "use our banking app to confirm operations, so your money is more secure", slowly being followed by remote attestation being employed to make you even more "secure".

But except for some dinosaurs insisting on SMS (which you can receive on a dumb-as-bricks phone), you can absolutely have 2FA without a smartphone. Most password managers handle it, with the bonus points of checking the domain when entering the TOTP. If you want separate baskets for your eggs, you can use dedicated TOTP apps (Authy works fine for my needs). You can even roll your own. You can use an external token like a YubiKey.

I may be missing something, but I have a really hard time understanding the "corporate backdoor / overwatch / control" argument when it comes to MFA.

Where I live the banks all require that you install their own smartphone app in order to confirm transactions. Literally not possible to confirm online transactions with a dumb phone (or a laptop for that matter, unless you can run the mobile app in an emulator).

> Where I live the banks all require that you install their own smartphone app in order to confirm transactions.

Same here in the Baltics, something like SmartID is prevalent and all major banks ask you to use it: https://www.smart-id.com/

Sometimes it's even integrated with document e-signing, to the point where it's hard to say where convenience ends and dependence begins (since something like TOTP or PGP aren't offered as alternatives).

After a quick glance over the site, it seems the system is fairly open, and they explain how they use the keys. The part on which I'm not clear is the app: is it not possible to build your own app that complies with their various interfaces, which would run on, say, a PC? Those seem to be documented.

I doubt the bank will let me run an alternative app to their "tap 'yes' and type in your mobile PIN within the next 3 minutes to confirm the operation" functionality. Hell, after I broke my phone, I had to call the bank's support for them to manually authorize the new instance of their app as an "authorization tool". If there are procedures to do this with third-party software, I haven't heard or seen them mentioned anywhere, much less documented.

I was talking about the smart-id scheme, which seems to be a "generic" thing, to be used by random different things.

For banks, I don't think that they'll allow use of 3rd party apps, either.

In my case, I think something must have happened because that used to be the case. You might be able to jump through some hoops to avoid that (never tried), but the funny thing is that I didn't do anything with my "professional" account for it to automatically switch back to SMS. The first time it happened, I was actually surprised and thought something fishy was going on.

Maybe some law forcing that has passed in your country? I would find it odd that banks would voluntarily decide to stop forcing their app on users.

I'm not aware of any such law. What I suspect, is it has something to do that the app can only connect to one account, but in my case I have two (personal and pro), so it must have some issue handling both. I freelance in IT, so there's nothing too interesting going on in my professional account, so I expect them not to care too much, since I have the app for my personal account anyway.

It is "secure". It secures the corporation against the end user. That's what makes it attractive as a developer platform.

i have a symantec token thingy sent to me by my brokerage, it generates 6 digit key that I need to login. the author could easily get a similar thing from the bank, i used to have one from WellsFargo too

I used to have one from BNP Paribas in France. But they've phased that out to improve my security by using their app. Which was fine, since I didn't need to cart that fob around. But then they went and improved it even further for my company account by switching from the app to SMS.

Agreed, mandatory 2-factor authentication through ios/android is really what screws you. You can totally do without for the rest.

KeePassXC has Google Authenticator-compatible 2fa on Windows. I expect other programs do too, and for Mac and Linux. No need to keep a smartphone only for 2fa, unless you need something that Google Authenticator can't do

KeePassXC even has Steam-compatible 2FA. But Steam currently still requires some sort of stupid unbypassable mobile prompt in certain circumstances, so you can't ever truly rid yourself of the app.

Yep xc works on Linux too and comes with the 2fa feature too. On mobile you can look at keepassdx which uses the same field as xc for its 2fa.

This.

Problem still persists with mandatory phone number verifications every couple months. It's likely most services have a cronjob running for that.

I setup an old phone just for that (https://news.ycombinator.com/item?id=37655746). It acts more as a backup key than as a backup smartphone. Just like with house/car/bike keys, having a spare in case of loss/theft can save you a lot of hassle.

Depends on where you live I guess. There are two especially important apps where I live, Swish for instant cash transfer, and BankID for authorization to many websites, such as banks, tax office etx. Without them you are definitely handicapped.

Depends how all your friends communicate. If they're all in a WhatsApp or Facebook group chat, for example, having a dumbphone will put you on the outer socially.

Didn't there use to be a version of whatsapp for "feature phones"? Sure, it's not completely "dumb", but I'd expect those to have minimal to no tracking.

It really is that bad now.

I recently got a new phone to replace my Pixel 3 that's no longer receiving updates, and it took days to sort out all the "you must verify this device from your old device" bullshit. These apps are essential to banking, and also to my workplace (I had to call the IT department from one of my devices that thankfully didn't yet have an expired session).

And this is when I HAVE my old device. Imagine the chaos if my old device were lost or broken? Or if google suddenly decided to lock my account?

What do I use my phone for? Communication (Signal, Threema), 2fa, and work, and nothing else. And it's a disaster waiting to happen.

> What do I use my phone for? Communication (Signal, Threema), 2fa, and work, and nothing else

Sounds like a combination of reasons to switch (or bridge) to Matrix, use a 2FA program you can back up (such as Gnome Authenticator) and a problem for the IT guys at your workplace for your work-provided mobile :)

Sorry, no, that's just not how the real world works.

Matrix is an interesting idea that might even get there someday, but it's not there now, and won't be there next year. And even then, it's only one breaking change away from not working with some communications app I need.

And my workplace isn't going to provide a mobile just for the 2fa apps (multiple) I need, nor would I want to have to carry an extra device just for that.

It's a fragmented world out there, and going with an even more obscure and less supported solution isn't going to cut it.

(I'd argue that it /is/ there now, as of last week: https://element.io/blog/element-x-ignition. And should certainly be there next year. But i'm biased :)

Then of course, there's this: https://telegra.ph/why-not-matrix-08-07

I just calls my bank and dictate them where to send the money to. Then they say thank you and wish me a good day which is why I tries to sends money at least twice a week. I hopes they will never become AI. AI is so dumb and slow and devoid of obvious and subliminal suffering one can hears in the voice and be proud of what humans can cope with.

Reply on news.ycombinator.com