[BasilofBasiley]

While everyone took the opportunity to reply to you with "Not in my bank/country/to-my-awareness" This is what's happening in Portugal:

https://old.reddit.com/r/portugal/comments/1msc886/obriga%C3...

Effectively, if the client doesn't download the App, they will never be able to log into the homebanking website again. The bank enforced this and now if you login normally it will redirect to a page where you can download the app or use up one of three remaining chances to login. I am down to two. From now on, I'm only able to use ATM's or go to an actual teller to make payments and such. The app requires that I have a Google account or an Apple account and I think that's just messed up, specially for a Portuguese bank.

The app on the google store is pt.novobanco.nbsmarter if anyone is curious. It has interesting permissions as well.

Edit: This is the landing page (one login left, oh dear...) https://files.catbox.moe/x117iy.png

rsync, here you go:

https://reports.exodus-privacy.eu.org/en/reports/652314/

[wkat4242]

> While everyone took the opportunity to reply to you with "Not in my bank/country/to-my-awareness" This is what's happening in Portugal:

Well yeah but that's what you get when you make overly broad statements like "not in the EU".

[eikenberry]

You say "The bank"... does this mean Portugal only has one bank? If not, wouldn't this be a good reason so change banks? Maybe to a credit union (bank co-op) if they have those in Portugal as the members generally have much more of a say.

[BasilofBasiley]

When I wrote "the bank" I meant, the bank in question, which is the one mentioned in the URL. Hope this makes it clearer for you.

As for alternatives, yes there are, I'm still figuring which ones do not require an app on the smart-phone, though.

I believe I've found a fair alternative after asking a few friends but, I have to account for other factors as well, like, how secure their infrastructure is.

This is because offline 2FA keyfobs were never that popular in Portugal (to my knowledge), unlike 2FA via SMS which I find less secure that keyfobs, but now with the SCA directives from the EU, most banks are jumping on the App 2FA bandwagon. Some do offer a government issued alternative [0] but it still requires an app. I'd be perfectly happy to sign in with my Citizen's ID card reader but that is also rarely implemented (bank-wise), specially since the Chave Movel Digital app from the government [0].

Bottom line, most major banks are going in one direction (deploying their own apps onto customer devices), while smaller banks are staying put (with SMS 2FA) but their security was never that great. So I'm still prospecting and yes, there's a bank co-op on my list also.

Oh, and by "security" I'm mostly going by feel here. Like, if the web interface is a bit jankie I don't feel secure. I'm not going to look into obfuscated .js and pretend like I know anything about web security.

[0] https://www.autenticacao.gov.pt/a-chave-movel-digital

[GoblinSlayer]

Just use a strong password, then 2fa is redundant.

[geggo98]

Not sure where gp lives. But most banks here restrict you to 4 digits as the password. So basically a PIN. If you are lucky, you get 6 digits or even letters. But be careful: if you use “fancy letters” (symbols, umlauts, …) you risk locking your account: you will be able to set this password, but the actual login form won’t allow you to enter it. Banks here are highly regulated, so don’t hope for competent competition.

They mitigate the obvious security thread with mandatory 2fa (actually mandated by regulation). Some use this as an opportunity to push their apps: no separate 2fa method, but only integrated in their bloated app, that checks for rooted devices and only supports the newest OS.

It’s quite hard to find out in advance, what 2fa methods with which fees each bank actually requires. I remember that some of them had funny ideas, what a customer should be billed for 2fa SMS. I think it was 50 cents per SMS.

[rsync]

Can you expand on:

"It has interesting permissions as well ..." ?

I assume a banking app needs (temporary) permission to use the camera for check photos or things of that nature ... and possibly (temporary) use of location data.

I would be alarmed if it requested microphone or access to either contacts or photo storage ...

[BasilofBasiley]

I updated the above comment. Cheers.