Re: Codes sent by text message

Frank Slootweg <this@ddress.is.invalid> Wrote in message:

Dave Royal <dave@dave123royal.com> wrote:

Frank Slootweg <this@ddress.is.invalid> Wrote in message:
 

Chris <ithinkiam@gmail.com> wrote:

Frank Slootweg <this@ddress.is.invalid> wrote:

VanguardLH <V@nguard.lh> wrote:

[...]

  As Dave Royal also mentioned, your bank probably mentions/'supports'
one or more TOTP 'apps'/programs, but - assuming they have not
re-invented the wheel - their systems should be standards-compliant and
hence worke with any standards-compliant 'app'/program.

 
Sadly in the UK that's not the case. They either use SMS, an automated call
or their own TOTP available in their app.

 
  It's similar in The Netherlands, at least for my banks and other banks
I know of. But SMS and automated call are (AFAIK) not used. Just a
bank-specific hardware TOTP device (uses your bank card as one of the
factors) or TOTP in their apps. I use the TOTP devices, because it's not
much of a bother and more secure.

 
Does this bank-specific TOTP device use your normal bank
 credit/debit card (i.e. the one you you make payments or withdraw
 cash with) or a specific TOTP card. I have one of the latter -
 though the bank doesn't use it for payments requiring
 2FA.

 
  It uses my normal bank card. Mostly a debit card, because most 'local'
(in NL (and EU?)) on-line transactions can be done by a debit card,
which - in our country - is a safer card than a credit card. But also
some credit card transactions work with the bank's TOTP device (our
credit cards are issued by our banks).
 

Amex has recently taken to asking for 2 digits of my credit card
 PIN to authorise some transactions - after years of saying we
 should never reveal it.

 
  When I use my credit card in the bank's TOTP device, I need to give
the 4-digit PIN of that card, i.e. the PIN is one factor of 2FA, the
physical card is the other.
 

That's obviously OK on an offline gadget. It's providing (part of)
 the PIN to a website I find dubious - even if that website
 purports to be AMEX itself.

I don't know why NatWest in the UK doesn't use it's own credit
 card in its own TOTP gadget for 2FA. Perhaps because it uses
 Mastercard, whereas AMEX cards are their own.
--
Remove numerics from my email address.