@kaia For bank I'm kinda stuck with the one I have right now as it's the only one in 40km radius. There's also online only banks, but it's mandatory linked to a smartphone so I can't (plus I still pay in cash when I can). And there's no banks that implement 2fa emails so far.
@mangeurdenuage here banks use stand-alone QR code generators when you don't have a phone. they are pretty cumbersome, but I guess pretty safe. you put in the bank card, scan the QR code on the browser and it generates a one time code.
@phnt@mangeurdenuage for online banking it's a 2nd factor, the 2nd factor being the physical possession of the bank card with which the code gets calculated.
@kaia They don't have those here but they'll propose you a terminal you rent 15eur a month (which has a sim card :pika: ) and requires a USB connection with a spyware plugging in the browser.
>you put in the bank card, scan the QR code on the browser and it generates a one time code There was a banks in 2016 that had a standalone module you just added your card in it, no sim/usb connection required, you imputed you password and the key the bank sent an email too it gave you back a string to add to the payment process to be validated and it worked. So it resembles that but in a more automated way since you scan a barcode.
Banks are not respecting the DSP2 on this, people who do not have a smartphone or mobile phone or if they don't want to use an extra module must have a computer to receive an email for their 2fa.
@phnt@kaia Yeah, 2fa authentication mandate by the DSP2 is extremely badly made. It tries to solve an issue that can't be solved with this. The only way to solve this issue is to simply ban proprietary software and mandate fully free/libre computer course in school with certification to access the internet but that won't happen yet.
@mangeurdenuage@phnt I went fully proprietary, using several proprietary banking apps on the business GrapheneOS phone. I don't do anything on it besides business, so I don't really care about their junk apps.
@kaia@mangeurdenuage I dealt with proprietary apps on my phone by shoving them into a work profile that is turned on for a few minutes a day at best. Best of both worlds for me.
@mangeurdenuage@phnt oh, something you will hate though: TradeRepublic and Revolut use a proprietary face scanning tool. say you move your app from one phone to another, then you gotta re-scan your face. it flashes different colors on the screen while you hold it in front of your visage.
@phnt@kaia@mangeurdenuage >His phone. >But he still runs all the proprietary malware. If a bank ever tried to abuse me in that way, I wouldn't accept it.
@mangeurdenuage@kaia You can't win everything and being the guy in a friend group that refuses to use X, because X is bad, doesn't solve anything. Boycott barely does anything.
It's better to workaround problems than potentially being a nuisance on others.
@phnt@kaia@mangeurdenuage tfw the people I could call friends are fellow geeks most of them foss kind so they tend to also avoid those horrible things by default.
That said yeah boycott doesn't really do anything (unless it's very well organised for it to scale), but it shouldn't prevent supporting alternatives whenever possible and seeking them when they don't exists. It shouldn't be only refusal.
@mangeurdenuage@kaia@lanodan Boycott is an example I gave to explain my point. When all banks require a stupid app or you pay some stupid amount like 1€ for every online transaction you do online thanks to requiring some sort of 2FA and SMS being the only other option, inquiring them to change will do completely nothing. You think they care about maybe 2% of their users leaving when they have no place to go? Of course not. You can't boycott that. You can write to politicians in the hopes that they'll even read your email and hope they won't bodge the law, but that's about the extent of what you can do.
Same with being in a group of friends that use some proprietary chat app. When they refuse to switch to something else, you'll either be a nuisance because they have to talk to you in some other way, or you'll slowly lose contact with them. And I don't think that's a hill worth dying for. Hence why I said that working around those issues is the better option, at least for me.
The true solution to banks being stupid is cryptocurrency, but that has its own problems.
@phnt@kaia@mangeurdenuage Yeah cryptocurrency so far looks like a non-starter as an actual alternative because you still effectively end up with exchange points (banks original form) due to the stupid amount of different cryptocurrencies. And their fees are stupidly high you might as well pay the 1€ extortion that your bank has (luckily mine hasn't pulled that crap for SMS-2FA).
Pretty much why so far it's mostly been used for grey/black market kind of stuff as for them the only other way is cash.
@lanodan@kaia@mangeurdenuage In a weird twist, illegal cryptocurrency casinos currently have the best solution for paying with crypto. Generate an address on signup and monitor it. Every customer has its own address equivalent to a credit card/account number. No middleman required.
The choice of supported currencies currently boils down to maybe 5, the rest is just worthless meme money.
@phnt@kaia@lanodan >inquiring them to change will do completely nothing Did you try ?
>You think they care about maybe 2% of their users leaving when they have no place to go Never said otherwise.
>You can't boycott that Never said otherwise nor said you to do as such. You can start legal actions since they're violating the current laws. They often care about that. Last time I did that was with an ISP and it was successful (it was a clear abuse of a senior on the phone, took months by they bent just before juridic actions started).
>or you'll slowly lose contact with them I wouldn't know I never had such contacts.
>Hence why I said that working around those issues is the better option, And did I not add another solution for that ? did I not post my own temporary workaround solution for that ? (the VOIP part).
>but that has its own problems. The human problem as always.
@phnt@kaia@lanodan >They aren't breaking any since they give everybody above 65 the SMS auth for free. Yes they do as when you have no mobile phone they have to email to a computer.
It's in the law: "Les mesures de sécurité devraient être compatibles avec le niveau de risque associé au service de paiement. "
"Ces mesures comportent généralement des systèmes de cryptage incorporés aux dispositifs personnels du payeur, y compris les lecteurs de carte ou téléphones mobiles, ou fournis au payeur par son prestataire de services de paiement gestionnaire du compte par un autre moyen, tel que par SMS ou courrier électronique." "ou courrier électronique" https://eur-lex.europa.eu/legal-content/FR/TXT/HTML/?uri=CELEX:32015L2366
>I did not miss it, I couldn't understand what you meant, so I skipped it. np
> (96) The security measures should be compatible with the level of risk involved in the payment service. […] Those measures typically include encryption systems based on personal devices of the payer, including card readers or mobile phones, or provided to the payer by its account servicing payment service provider via a different channel, such as by SMS or email. > or email
@cjd@kaia@PurpCat@phnt@mangeurdenuage Been hearing about it for more than 10 years (first heard about it in 2014~2013), is there any deployments of it yet?
(btw gnu stuff doesn't uses a slash, that's for when there's two projects combined)
@cjd@kaia@PurpCat@phnt@lanodan I'm aware of it. It's just a handler, a good one imo, you can put any crypto currencies in it and as far my understand is on it, it's like cash, people can choose weather or not it's anonymous transactions. Thus why it's allowed since commerce who will get paid on their terminal won't be anonymous for their transaction (but if anyone choose to pay on their private wallet it will be anonymous). Just like cash would.
@cjd@kaia@phnt@lanodan@mangeurdenuage the problem is with paypal it's got your real name on every transaction and i don't need that when I'm sending money to furries online
@PurpCat@kaia@phnt@cjd@mangeurdenuage Yeah although in some jurisdictions (pretty sure that's the case for France) the Billy Bob part can be a name people recognise you for rather than say your government-mandated name.
Furryism is basically supported by the western establishment so normally you shouldn't have anything to worry about. If you were sending money to Christian Nationalists, THEN I'd be concerned...
@cjd@kaia@PurpCat@phnt@lanodan >you have nothing to fear from the power structure I'm going to repeat what Mr.Grothoff told me almost a decade ago (gnunet/taler founder).
@cjd@kaia@phnt@lanodan@mangeurdenuage lmao furries aren't a protected class it's just a shit fandom that wishes it were a protected group by the government but if it was I'd be able to get city grants and loans and scholarships for telling the government and admissions officers what pokemon i think has the best paws
I think furries should be close enough to LGBT to be able to take advantage of the protections. I mean at the very least, current establishment will never actually pursue you. You might be able to get some handouts by leaning on the "Queer" classification.