Gemini Users: We're Going to Look at Your Texts Whether You Like It or Not

I haven't seen any of that in the US, still only SMS nags. It seems like banks that mandate login nags that only work with the latest devices should still be pretty rare? (with understanding and sympathy to any regions where they aren't).

I'm in the US and both the banks I use do this. It's probably optional but SMS 2FA is a complete joke due to the major security flaws of SMS. Presumably they could use a generic 2FA app but then it means they would have to provide technical support to the n-millionth backdoored spyware app that app stores get games to promote which has accountability and compliance implications. Another thing the apps do is instant confirm of suspicious activity and Google Pay which my understanding is keeps card numbers out of store databases that keep getting breached every other month.

From my perspective all of the "2FA" are nonconsensual steps I'd rather not do, so the easiest options are the least worst. My SMS# for them is a GVoice which goes to my email. Somewhere far down on my todo is a script that just watches for those emails and spits out the code in a terminal for easy pasting.

Specifically, Ally, Cap1, BoA, and my local bank all only make me do SMS/email nags at worst. If any of them started pushing trash like expecting to force me to install their app on my actual in-my-pocket-when-out cell-plan phone, I'd drop them like a bad habit.

I've never really had a problem with unauthorized transactions, and I'm generally not squeamish about random online retailers (though most seemed to have moved to Shopify, shrug). Generally the most important thing you can do to protect yourself against fraud is review the transactions on your account within 30 days, so any feature that makes it more difficult to do this actually hurts you.

Boy I hope your Gmail is never hacked and I also think it's a bit comical that you would build your financial security out of some Rube Goldberg Google service contraption while telling yourself that you're fighting the good fight against Google's encroachment in your life.

"Financial security" ? Don't you think you're overstating that a bit? We're talking about bank accounts bound by Regulation E, not bearer tokens like cryptocurrency.

Traditional bank accounts are quite close to an open ledger - the only thing one really needs to initiate a transaction against an account is the account number, which is printed on every check. As I said, the biggest fraud risk is not checking your accounts every ~30 days. Do this, and your liability is basically capped at having to fill out some paperwork and change account numbers.

The "Rube Goldberg contraption" is to mitigate the nonconsensual SMS nag by making it as easy as possible. My login security relies on my passwords. If someone can get those passwords, it means they've pwned my computing infrastructure and I have got much bigger problems than cleaning up unauthorized bank account activity.

As for GVoice, I chose to start using it because I saw Google and AT&T as similar attackers. I've stuck with it because it works for more of these types of things than other VOIP providers. With "AI" that original calculus might be changing, and if (when?) I decide to jump away from that then I'll probably move towards something like @rsync's "2FA Mule".

Which banks support 2FA mules?

I would think all of them, because it's just another prepaid SIM like many people's actual phones. On that front, Ally SMS stopped working with GVoice (I just do the voice call when they want to nag, that still works). And way back I experienced some random issues with Cap1 - it seemed like they were trying to grab the subscriber record as a form of verification (sigh).