While it is possible, I don't think the average consumer has a dedicated card reader and HBCI software. I just checked a few random banks and none of them even advertise that on their homepage. Most people use browser-based banking plus a way to generate transaction tokens (e.g. via SMS, smartphone apps, or a small token generator that takes input).

The Commerzbank advertises it on the homepage of their online banking, and when you try to activate online banking, they suggest it, too.

And the chip reader is required for the new Personalausweis anyway.

Unless I am missing anything, Commerzbank has a small text on some of the sites "Using HBCI? This is how to activate". That's hardly advertising, nobody how doesn't already knows what this is about will click on that. All their interactions on the site seem to steer people to mobile or photo TAN.

To me it looks like nobody actually uses the Personalausweis online. Just recently, companies have switched off their support (e.g. HUK or DKB). And the majority of the readers around are just RFID readers without any dedicated keys or display (which obviously is not a secure way) which can't be used for HBCI.

>This is the average way a consumer does online banking, and it’s much more secure than on iOS.

lol. At least on iOS they can trust what they see.

On desktop they can't, https://securityintelligence.com/tatanga-attack-exposes-chip...

All of your security theater falls apart when the device is infected with malware that can make the bank site say anything.

On iOS your banks app/site will never ever lie to you, if it does it'll almost certainly be the banks fault and not the users.

The idea is to get a dedicated device[0] which uses your bank card to sign the transaction and shows transaction details on its own display. That's probably even harder to infect than iOS.

While German banks support that almost universally, hardly anybody uses it.

[0]: https://shop.reiner-sct.com/chipkartenleser-fuer-die-sicherh...

Yeah, and then the banks site will just tell the user to approve the "test transaction" on their devices screen. Or that they need to approve it or all of their funds will be frozen, or whatever.