Gemini Users: We're Going to Look at Your Texts Whether You Like It or Not

First, banks generally have websites. Second, if the website sucks and your prefer the app (happens plenty), get a second older device that isn't de-googled and stays at home. There is no need to put all your eggs in one basket.

Many banks use their apps as biometric 2FA for website login nowadays.

I haven't seen any of that in the US, still only SMS nags. It seems like banks that mandate login nags that only work with the latest devices should still be pretty rare? (with understanding and sympathy to any regions where they aren't).

I'm in the US and both the banks I use do this. It's probably optional but SMS 2FA is a complete joke due to the major security flaws of SMS. Presumably they could use a generic 2FA app but then it means they would have to provide technical support to the n-millionth backdoored spyware app that app stores get games to promote which has accountability and compliance implications. Another thing the apps do is instant confirm of suspicious activity and Google Pay which my understanding is keeps card numbers out of store databases that keep getting breached every other month.

From my perspective all of the "2FA" are nonconsensual steps I'd rather not do, so the easiest options are the least worst. My SMS# for them is a GVoice which goes to my email. Somewhere far down on my todo is a script that just watches for those emails and spits out the code in a terminal for easy pasting.

Specifically, Ally, Cap1, BoA, and my local bank all only make me do SMS/email nags at worst. If any of them started pushing trash like expecting to force me to install their app on my actual in-my-pocket-when-out cell-plan phone, I'd drop them like a bad habit.

I've never really had a problem with unauthorized transactions, and I'm generally not squeamish about random online retailers (though most seemed to have moved to Shopify, shrug). Generally the most important thing you can do to protect yourself against fraud is review the transactions on your account within 30 days, so any feature that makes it more difficult to do this actually hurts you.

Boy I hope your Gmail is never hacked and I also think it's a bit comical that you would build your financial security out of some Rube Goldberg Google service contraption while telling yourself that you're fighting the good fight against Google's encroachment in your life.

"Financial security" ? Don't you think you're overstating that a bit? We're talking about bank accounts bound by Regulation E, not bearer tokens like cryptocurrency.

Traditional bank accounts are quite close to an open ledger - the only thing one really needs to initiate a transaction against an account is the account number, which is printed on every check. As I said, the biggest fraud risk is not checking your accounts every ~30 days. Do this, and your liability is basically capped at having to fill out some paperwork and change account numbers.

The "Rube Goldberg contraption" is to mitigate the nonconsensual SMS nag by making it as easy as possible. My login security relies on my passwords. If someone can get those passwords, it means they've pwned my computing infrastructure and I have got much bigger problems than cleaning up unauthorized bank account activity.

As for GVoice, I chose to start using it because I saw Google and AT&T as similar attackers. I've stuck with it because it works for more of these types of things than other VOIP providers. With "AI" that original calculus might be changing, and if (when?) I decide to jump away from that then I'll probably move towards something like @rsync's "2FA Mule".

Many modern banks, so-called "neobanks", provide a very limited web version that's only good to check the balance. And you are forced to use their app.

You make me glad I only use credit unions.

Which banks support 2FA mules?

Honestly I appreciate these features.

I would think all of them, because it's just another prepaid SIM like many people's actual phones. On that front, Ally SMS stopped working with GVoice (I just do the voice call when they want to nag, that still works). And way back I experienced some random issues with Cap1 - it seemed like they were trying to grab the subscriber record as a form of verification (sigh).

What are they doing that benefits you?

So then don't use them? That is also the segment of the market that doesn't offer FDIC coverage on deposits.

There are always crappy gimmicky options. They only matter if you're forced into using them for whatever reason. Banking has a pretty strong factor of needs to work for older person of means that isn't itching to be on the treadmill of corporate technology. At least for now.

For one, it integrates Google Wallet and creates a virtual card so the actual credit card number doesn't end up in those merchant databases that get constantly breached. This ties the credit card number to use of the secure element in my phone which is configured to require biometrics to activate. That makes it extremely difficult to fradulently bill. Yes, you can fight fraudulent charges etc but that costs me time and effort and to be it's a no brainer.

I also like the convenience of using Google Wallet to pay for things. It's by far the fastest transaction and easier than futzing around with chip cards and pins. It's also more secure than the dumb tap to pay bullshit in credit cards themselves which do not require biometrics or pins. (Currently my main card is too old to include tap to pay, so I don't have to worry about how to disable it yet). Just generally Google Wallet is more secure than chip+pin while also being much easier to use and not having to trust some random keypad.

It's also nice to not even have to carry a wallet around. I'm not fully there yet (Apple supports my state's drivers license but Google Wallet support isn't ready yet). Phone is obviously something I take with me, it just makes wallet so vestigial since Apple Pay/Google Wallet support is becoming very ubiquitous.

My banks have also implemented 2FA login by just push notification so no typing number or such tedious stuff. Unlock my phone, pass biometrics and done.

There are more but those are just the first things that come to mind.