El Fri, Mar 19, 2021 at 09:33:09AM -0400, fsfe@centromere.net deia:

I recommend the following:

1. Physically visit the bank, look the teller in the eye, and complain

vociferously (yet respectfully), 2. Use cash while you still can, 3. Build a strong community who understands what's at stake, 4. Shop locally, and 5. Pray.

Yes, even 2FA with SMS requires you to have a phone and a contract with a telco. What was so wrong about that system they used before of a code card that the bank gave the customer and then a code at a diferent coordinate was used for each transaction ? Make it bigger (a booklet), or add manual pseudosteganography or pseudocrypto and be done with it.

Now they move it to a device that hasn't physical security (because people carry it around with them when they go around, so it's easily lost or stolen), hasn't logical security (because phones are jailed and people install all sort of dubious apps, and it's all proprietary stuff most often) and has no network security (because SMS, when they use that, have been broken, and because SIMs are stolen with just social engineering).

Whatever is used for 2FA should be practical to leave at home (you don't need to bank on the go, not always, anyway), something you can use with no matter what device or network (public library if you don't have internet at home) and as simple as possible to avoid vulnerabilities. If they want to replace the code card (or code booklet) with a small device, ideally something like Precursor with free software, that might be acceptable, but even that looks too complex.

The whole idea of credit cards where you need to give your credentials to your counterpart and then keep watching if the charge is wrong to revoke it (and the merchant keeps watching whether the payments received are revoked) is backwards. The seller should give you an invoice with bank details and amount due and you should start a transfer with your bank. Or better yet, something like GNU Taler.

The Big Brother risks will be there anyway with any clearing house, be it SEPA transfers, credit cards, GNU Taler or anything. Only cash can avoid that, because cryptocoins create more problems than they solve, even with banks competing so hard to create the most problems that they may one day force me to reconsider it... But to pretend to install code in your systems or even have your phone number is just to erode your privacy, not to secure anything.

And, Jure Varlec: no, I don't think yours was a rant. It's a very reasonable complaint even if I can't help you about it, unfortunately.

Hi Jure,

Easybank.at still offers SMS TAN. However, I'm curious how long they'll "be allowed/willing" to keep it that way.

Regards, Peter

Am Freitag 19 März 2021 21:01:13 schrieb Jure Varlec:

A dedicated device is a good option, IMO.

Yes, this works fine.

But I find it most interesting that you still have SMS as an option. My bank (and others) used to offer the same service, SMS-based second factor. But now, representatives of every bank I talked to claim that the EU directive and/or the protocol used by credit card companies (3-D Secure, if I'm not mistaken; there are several marketing terms for the same thing) require use of something stronger, i.e. an app.

We could try to check: Does the directive forbid SMS as second factor?

Some of the credit cards seem to go to the bank for an additional verification and some banks seem to be able to use what they always use.

I'm from Slovenia. I should have noted that fact, given that my question is tied to it, I just forgot.

No problem. I just think it may allow some people to comment on the local conditions in your country (like having a recommendation).

...

Some general advise (which you probably have tried as well):

• Some banks do not know which standard they are actually using, maybe some offer something a general app from f-droid.org can do.

Which standard are you referring to? I know of no bank that would offer an open API to access their services. Spurred by your suggestion, I searched f-droid once more, and I do see Bankdroid there. Apparently, Swedish banks do offer some limited API, but it doesn't seem to go beyond showing the balance of your account. Am I missing something that will work with 3-D Secure?

I was thinking that for a second factor banks could potentially use the standards for one time passwords, like HTOP or TOTP for a random example app see https://f-droid.org/en/packages/org.cry.otp/ However I don't know if there is any bank offering this. (If not, I'd be interested to know why.)

[Using the Aurora store on a non-google phone] (Thanks for correcting my typo, Andrea. :) )

If my information is current, Magisk and microG don't give you a working SafetyNet at this time. And I wouldn't want to rely on it for banking anyway because SafetyNet is an arms race so it's bound to break every once in a while. There's also the little issue that DroidGuard needs some proprietary software; it probably pales in comparison to a bank's app itself and the drivers needed to make a phone work, but still ...

True, it is an arms race, but hey, an emulated computer is also a computer and if this it is mine, I should be able to run the software on it which pleases me. So the whole "tamper" protection is a two edged sword at least.

Regards, Bernhard