AFAICS, no, they don't. If you don't install the bank's app, you are usually offered to use a stand-alone hardware TAN generator. I currently have 4 TAN generators for different bank accounts (because everybody seeems to use a different protocol).

On the positive side, a stand-alone air-gapped TAN generator feels much saver than using a (possibly back-doored) smart-phone to do on-line banking.

For people outside Germany, here's what a TAN generator looks like: https://www.pcdirekt.de/hardware/tan-generator/

Obviously I can't speak for every country and every bank, but at least in two countries and with two banks they are trying really hard to get me off the hardware tokens and onto mobile phones.

They have done all kinds of dark patterns, for example they update the website (which eventually becomes a mandatory update), but that requires relinquishing the hardware token, or they update their mobile app, and if you even try to log-in into the new app they automatically cancel your token, etc.

When my token's battery died, they didn't want to give me a new one. They said they don't offer the service anymore. Only after escalating N times and explaining that I need a hardware token because their SMS-based 2FA didn't work internationally they gave me a new token. Suddenly it wasn't discontinued anymore. Now they moved off SMS-based 2FA to some mobile app, so I suspect next time I need a token I won't be able to get it.

Make no mistake, enjoy your TAN generator while you can, because you will not be able to enjoy it for long.

In the country I live in right now, the only way to get a proof for your COVID-19 vaccination is if you "voluntarily" enroll into some phone-based authentication scheme with your government that requires a modern, non-jailbroken iOS or Android device.

Yes, exactly. Maybe you can protect yourself (a bit) by having two phones. One for browsing and communication and one to get official (banking/vaccination/etc) stuff done.

In germany (and I'd assume standardized throughout europe) COVID vaccination digital certificate is just that: a digitally signed certificate (encoding your name+vaccination meta-info) passed around via QR code. While you can use an App to read and present it, just having a paper-copy of the QR code (plus some ID document proving that the name on the certificate matches your person) should be enough to prove your vaccination status.

There is nowhere to get a paper copy from in my country. At least not without going through insurmountable hoops. I tried.

You have to log-in to a government website, and you do it either through a mobile phone registered with the government, or with a smartcard and a proprietary Java application. Pick your poison. (And they don't want to issue new smartcards either.)

I'm not in Germany, but I am currently moving banks because the only way to do online banking is to have an Android or Apple phone, either for 2FA or for mobile banking. They don't have hardware generators. I currently have an old Windows phone (unsupported) and a Pinephone (unsupported), so no online banking for me.

This is so weird to me. I'm over here in the US using a website with a regular old password, no 2FA or anything. Same thing at multiple institutions.

I've run into a few that require 2FA - either SMS or email, your choice.

There is a new EU regulation that requires certain security considerations. Sadly, all banks decided that the best way to implement those was to develop a proprietary solution for themselves and completely avoid anything even close to being standardized.

What bothers me is they all had 2FA in the form of certificates or SMS auth, and most of them moved off of that to some other solution (current bank has 3rd party login which I can do with a cert, the old bank only has an app). What's wrong with cert auth? It can't be less secure than an android app.

Some banks offer it (usually those with higher fees), but unless you count every separate Sparkasse and VR as their own Bank (for non-Germans: It’s similar-ish to a franchising system), I wouldn’t say "usually".

You mean a phone to receive a text for MFA? "Most" can't be more than that.

However there are a couple of new "Fintech" banks in the UK that are mobile app only. No website and I assume very difficult to get anyone on the phone. That seems crazy to me. Access to your bank is at the mercy of Google/Apple.

They probably require something like SmartID, which means that you need to have a smartphone that's not rooted. Ie can't even use LineageOS.

Rooted is unrelated, some apps require it, others don’t. But several require their proprietary app to access the online banking website from your computer.

Rooted is related in that some apps will refuse to work, or will disable features if they detect that the phone is rooted.

Until SafetyNet is improved you can still hide you're rooted via MagiskHide.

I wrote that, yes. But my comment was about the broader situation and not just about the apps requiring root.

Mine has it as an option, but it also supports this[1] external tan generator. I use it since I do not understand how a single device that could hold all the data needed for online banking can be considered 2 factor, when its 1 factor at best.

[1]https://www.mediamarkt.de/de/product/_reinersct-tanjack%C2%A...

Some banks in Germany support chipTAN which doesn't require a phone. You can find a list of banks supporting chipTAN here: https://www.kostenloser-girokonto-vergleich.de/diese-banken-...

That list is outdated. I was doubtful DKB (which you can’t even use with rooted Android devices, I had to cancel my account via customer support because they decided to cut me off with a minor update) allows chipTAN, and the latest comment is that they stopped supporting it.

I'm regularly using chipTAN with a stand-alone TAN generator (similar to [1], based on optical flicker-code) for a DKB account. No problems so far.

Deutsche bank uses PhotoTAN, which supports hardware TAN generators [2].

Some banks use different but similar TAN generators (e.g. SecurePlus [3]), and I also witnessed Postbank accounts operated with USB-based TAN generators [4] called "BestSign".

[1] https://www.voelkner.de/products/476429/REINER-SCT-tanJack-o...

[2] https://genostore.de/db/phototan-lesegeraet/92/phototan-lese...

[3] https://cb.kobilshop.com/secureplus-generator/1/secureplus-g... securePlus Generator

[4] https://www.seal-one.com/devices.en#DiVc3100KLink BestSign

You are right and I stand corrected