[LINK] RFI: Opening an account with Google without a phone-camera

[Craig Sanders]

On Mon, Feb 16, 2026 at 08:06:03AM +1100, Roger Clarke wrote:

> There's been a marked falling-away of tokens, as in separate, physical
> artefacts containing a time-based OTP generator.

My bank, Bendigo Bank, forced me last year to switch from the physical token
I've been using to login to my online banking for decades to an OTP via SMS.

I complained, but this was not optional, it was mandatory.  After further
complaints and resistance from me, they said they could also do an OTP via
email.  I reluctantly chose that because I run my own mail server and the
short-lived (30 sec) OTP would be encrypted via TLS during transmission.
Not perfect but much better than the completely insecure SMS method.  GPG
encrypted email was beyond them.

They were promoting this as a security UPGRADE, when it was clearly a massive
security downgrade.

Probably because it was cheaper. Or they were following the latest idiotic fad
pushed by corporate security weasel-"consultants". or wanted to gather mobile
numbers for SMS spam purposes.

craig