Hacker News Reader

Comment by t0bia_s | Hacker News Reader

I'm not using Google play or any other services on android over 6 years now. You don't need banking apps for making transactions.

View on HN

I live in an EU country and I, in fact, cannot use online banking without a Google-enabled Android or an iPhone. There is exactly one bank that offers a desktop authenticator, but we had a really bad experience with them when we tried them for a year.

MicroG could work, but I never used banking app, so I cannot verify it. Adopt paying by other, more secure and private friendly ways.

What payment method would you recommend for paying mortgages, utility bills, and company expenses?

You said you're in the EU right ? SEPA works. The only moment I need to confirm identity with my bank is when I buy frivolities, not for my bills.

Here's the problem: I can do a SEPA transaction using online banking (with a Google-enabled phone) or by walking to my bank personally.

I might be lucky enough to have online banking work with sms and a pre-shared secret. My bank (also in the EU) didn't tell me I could do it automatically, they only mentioned it when I told them I lost my phone (it was true) and that I didn't know when I could buy a new one. Maybe it'll work with yours ?

No, ever since PSD2 came into effect, banks here refuse to do SMS-based verification and have switched to apps. They also don't support hardware authenticators for consumers. I asked.

Fortunately we have competition and possibility to switch to banks that are more private and user friendly.

I have accounts at 1 Swiss bank, 2 German banks, and 2 UK banks. None of them require an app for any functionality.

You can get a little hardware thing to generate their OTP codes, as an alternative to apps.

The hardware dongle sounds like it might be TOTP. There are plenty of clients for that for laptops and phones, assuming you can enroll your own secret.

likely, but it's a custom time based token from RSA that you definitely will never get the keys out. so the implementation doesn't matter much.

Unfortunately it's not plain TOTP. Most banks in Europe give you a standalone cheap plastic smart card reader into which you put your bank card.

The website shows you a code. You input it into the reader, followed by your card PIN. The reader outputs a code you put into the website.

This is what it looks like:

https://www.post.ch/-/media/portal-opp/k/bilder/postgeschich...

I live in a EU country as well, Netherlands to be exact. Never had an issue with any bank. What are you talking about?

Netherlands today is more like the USA. anything it can fight the EU it will. it's the reason it's the new silicon valley with all tax dodging companies moving there.

and it's not going to improve. second factor auth in Europe now legally means "second factor auth via means the gov can positively link your Identity".

for anything EU or eu commission, you must either have an app in stock OS smartphone, or receive a sms on a network they can validate sim is attached to a tax id, or nothing else is allowed. totp et al is legally verboten.

Reply on news.ycombinator.com