Hacker News Reader

Comment by duozerk | Hacker News Reader

> Also, what kind of banking are people doing that requires an app? I genuinely don't know what it could be.

Close to every bank in the EU requires their user to have an app, for MFA (both for logging in and for validating transactions - transfers, payments). They use the smartphone's TPM. I have yet to see one that allows you to use your own MFA app.

The few I've seen that don't require it will validate the same through text messages (not everyone has a smartphone); though if you associate their app even once, you're screwed - the app it is from now on.

View on HN

>Close to every bank in the EU requires their user to have an app

Possibly this was hyperbole but in any case it's not correct at all.

Anecdotally, of my two EU (massive legacy French) banks, neither requires a mobile app. SMS all the way.

Even Wise, a cutting-edge neobank, does not require you to use its app. And its website accepts standard TOTP authenticator for 2FA.

Revolut is app-only, which is why I never use it.

Here in The Netherlands banks used to offer authenticator devices, which they are phasing out (you can still use them, but they wont replace them once they run out of battery). Pretty much all banks switched to app-only.

No SMS at all (which is not surprising, because SMS is not secure).

Also, IMO fingerprint/face-based authentication is much nicer/quicker, especially for online payment flows like iDEAL (Dutch predecessor to Wero). And banks here work on GrapheneOS, so not much is lost.

>And banks here work on GrapheneOS

Until they don't.

> Anecdotally, of my two EU (massive legacy French) banks, neither requires a mobile app. SMS all the way.

My wording was bad, sorry; but try to install their app just once. After that, I'd bet you won't ever be able to go back to SMS validation (which is what I was talking about at the end of my comment).

If not, I'd be curious to know the banks you're talking about (to consider switching to them, for one thing). What I said above is true of Caisse d'Epargne, HSBC, CCF, among others.

>I'd be curious to know the banks you're talking about

Fortuneo (internet-only subsidiary of Crédit Mutuel) and LCL. I have had both their apps installed at points in the past. In both cases they defaulted back to SMS 2FA upon uninstalling, though I remember worrying I would have the problem you describe.

Ultimately I can't see how a bank could get away with forcing (rather than just pushing) existing customers to install an app. This would surely be a breach of contract.

> though if you associate their app even once, you're screwed

Can you go in branch and get that fixed?

Reply on news.ycombinator.com