An honest yet pointed question: what permissions does your bank's 2FA app request? My guess is, as a bank, they're doing the right thing. However, permissions overreach is a real issue that even "legitimate" apps are exploiting to vacuum as much user data as possible.

> My guess is, as a bank, they're doing the right thing

Banks can and will do everything wrong.

* https://reports.exodus-privacy.eu.org/en/reports/fr.creditag...

* https://reports.exodus-privacy.eu.org/en/reports/fr.lcl.andr...

* https://reports.exodus-privacy.eu.org/en/reports/com.caissee...

* https://reports.exodus-privacy.eu.org/en/reports/fr.banquepo...

* https://reports.exodus-privacy.eu.org/en/reports/com.fullsix...

What solution would you recommend? Strangely, those are all banks I have never heard of. My employer had no search results on that site. I guess they aren't doing everything wrong.

Aegis installed via F-Droid is probably the safest option, as it's open source and verified by F-Droid before being listed.

Just use an open source app. Download all app from Fdroid for android.

> My guess is, as a bank, they're doing the right thing.

In my country, banks used to mandate use of a "security module". I decided to see what this thing was doing and caught it intercepting every single network connection.

what a nightmare, imagine a unique 2FA app for every account!

I will not install your sketchy app.

Do you supply source and repeatable build info?

Exactly. I would never ever install a bank's app on my phone.

Aside from almost certainly being closed-source it was probably developed by the cheapest off-shore bidder for the project. But who knows? That's the point. They won't tell you anything because they "take security very seriously."

If I put up an app that looks like yours how quickly will it be noticed by your bank/google?

My bank's 2FA consist of text verification which has notable issues.