Hacker News Reader

Comment by alpaca128 | Hacker News Reader

Where I live having the app for 2FA is mandatory for online banking unless you can convince them to give you a hardware TAN generator. So transferring money is actually much less convenient in the browser because everything I do has to be confirmed with my pin in the app, so I might as well just do it in the app directly and only login on one device instead of two.

Of course this is actually "phone factor authentication" and not two-factor authentication, but I kinda need a bank account.

View on HN

Ugh. Sorry to hear that. I use 1Password for TFA, and I haven't had to use an app.

When I first run an app, and it asks for access to camera, microphone, photos, calendar, contacts, and location, I tend to immediately plonk it; regardless of its purpose.

I have a PMB, and the store has an app that uses the phone to unlock the door, after hours.

There is a keypad, but that hasn't actually worked, in months, and the store has ignored my reports.

I just go there, during business hours, even though it's inconvenient.

I just recently started a job that uses 1Password, which I've used personally for years, but they also recommend the 2FA built into 1Password. It's incredibly convenient, and I "know" it's as secure or more secure than using my phone, but man I just haven't been able to get over that mental hurdle of putting all my auth eggs in that 1Password basket.

With a touch login on the phone and (say) google authenticator IMHO it's considerably less inconvenient to login into something online with the desktop than what Chase does to me. The phone is sitting right there anyway, and 6 digits to type in by hand is not that big a deal. I do it all the time.

Basically the phone is the 2FA generator.

Does "the app" mean the site's app?

I mean the bank's phone app. It is locked to one specific device and is the only possible method of authentication. I either need to use the app itself, or confirm every login and transaction in the app when using a browser.

My bank has a similarly unhelpful approach, but at least the SMS code expires, and my phone never sees my bank password at all.

Reply on news.ycombinator.com