Worry not: in 20 years’ time people born in 2028 will all pretty much look like kids to you.

Ah, right - I misunderstood that point you were making.

So, as it turns out, we’ve been in agreement all along.

Not living in the US, I’m not up to date with US salaries.

That said, even for administrative personnel paid $25/h, $25 will pay 1h of somebody’s work which is way beyond what is needed to close a retail customer account in any modern administrative system were such thing is a common operation which should take less than a minute to do, because people who design the kind of company administrative computer systems (such as yours truly, at least during part of my career) will make the most common business operations be the fastest to do in that system.

It deceives people whose idea of how things work in large companies hasn’t changed since the days when it was the manager of your bank branch who decided if you you should get a loan or not.

Nowadays, for certain in middle and large size companies, all the administrative main business pathways are heavilly if not totally automated and it’s customer support that ends up eating the most manpower (which is why there has been so much of a push for automated phone and chat support systems, of late using AI).

Those $25 bucks for “account closure” pays at worst for a few minutes of somebody’s seeking the account from user information on a computer, cross checking that the user information matches and then clicking a button that says “Close accout” and then “Ok” on the confirmation box and the remaining 99% or so left after paying for that cost are pure profit.

As somebody who works in designing software systems, including for large companies, lets just say that the amount of human time that goes into a customer account closure is negligible because main business operations such as openning and closing customer accounts are the ones that get automated the soonest and the furthest.

The stuff that uses “lots” (in relative terms) of manpower is supporting customers with really unusual problems involving third parties and even then spending 2.5 h man/hours (assuming the administrative person get paid $10/per hour) is pretty uncommon.

You’ve been lied to, repeatadly, for at least 3 decades.

“Perceived value”

Without that element, there would be no explanation for Marketing other than pure Brand Awareness promotion working (and McDonalds is definitely beyond needing more Brand Awareness, at least in the Developed World)

Even then, it doesn’t explain a lot of how Marketing does its work (namelly the stuff they took from Psychology and use to do things like create associations between brand and specific feelings on people’s subconscious - you know, the way cars are “freedom” and perfumes are “sex”).

And don’t get me started on other techniques that prey of human cognitive weaknesses (for example, FOMO would not work with the fabled Homo Economicus that underpins so much of Free Market Theory)

Anyways, a ton of present day enshittification (and that includes this kind of price inflation) relies on people having a well entrenched positive perception of a brand after years of having a relationship with it (i.e. chosing it as customers) and there being quite a lot of momentum behind it. It also relies a lot on using a “slow boiling” effect to keep people from spotting the full picture of the changes.

I literally have two machines running on always on VPNs, one my personal PC and another a home server were a torrent service is running, and have no such problems.

I think maybe the mistake you made was spending most of the time with it OFF and then turning it ON once in a while, whilst mine just goes ON as soon as I boot my machine and stays on.

Granted, I’m not using it for getting around geo-locked websites, I’m using it for having a bit more privacy and for safety when sailing the high seas so once in a while I have the opposite problem (that I’m blocked from accessing sites in my own country because the connections appear to be coming from a different country).

Well, I haven’t really made any large wire transfers to accounts outside the EU from that bank in over a decade so can’t really confirm or deny.

I do know that in past experience with banks in general, the people checking the validity of suspicious transations (and large transfers to accounts outside the EU tend to fall into that classification given the prevalence of online scams from countries were the Law is a bit of a joke) will actually call you, or at least they did in the UK some years ago (pre-Brexit) which was the last time I had experience with something like that.

(At one point I also worked in a company that made Fraud Detection software).

Maybe they switched to SMS to save money, I don’t know.

Ah, I see.

Your point is that the use of a secondary channel for a One Time Pass is still an insecure method versus the use of a time-based one time password (for example as generated in a mobile phone app or, even more secure, a dedicated device). Well, I did point out all the way back in my first post that SMS over GSM is insecure and SMS over GSM seems to be the secondary channel that all banks out there chose for their 2FA implementation.

So yeah, I agree with that.

Still, as I pointed out, challenge-response with smartchip signature is even safer (way harder to derive the key and the process can actually require the user to input elements that get added to the input challenge, such as the amount being paid on a transfer, so that the smartchip signs the whole thing and it all gets validated on the other side, which you can’t do with TOTP). Also as I said, from my experience with my bank in The Netherlands, a bank using that system doesn’t require 2FA, so clearly there is a bit more to the Revised Payment Systems Directive than a blanked requirement for dynamic linking.

It think you’re confusing security (in terms of how easy it is to impersonate you to access your bank account) with privacy and the level of requirements on the user that go with it - the impact on banking security of the bank having your phone number is basically zero since generally lots individuals and companies who are far less security conscious than banks have that number.

That said, I think you make a good point (people shouldn’t need a mobile phone to be able to use online banking and even if they do have one, they shouldn’t need to provide it to the bank) and I agree with that point, though it’s parallel to the point I’m making rather than going against it.

I certainly don’t see how that collides with the last paragraph of my original post which is about how the original thread poster has problems working with banks which “require a separate device that looks like a calculator to use online banking” which is an element of the most secure method of all (which I described in my original post) and is not at all 2FA but something altogether different and hence does not require providing a person’s phone to the bank. I mean, some banks might put 2FA on top of that challenge-response card authentication methods, but they’re not required to do so in Europe (I know, because one of the banks in Europe with which I have an account uses that method and has no 2FA, whilst a different one has 2FA instead of that method) - as far as I know (not sure, though) banks in Europe are only forced to use 2FA if all they had before that for “security” was something even worse such as username + password authentication, because without those regulations plenty of banks would still be using said even worse method (certainly that was the case with my second bank, who back in the late 2010s still used ridiculously insecure online authentication and only started using 2FA because they were forced to)

I literally said 2FA over SMS is not secure because of weaknesses in the GSM protocol.

It’s still more secure than username + password alone, but that’s it.

Those little boxes are just a bit of hardware to let the smartchip on the smartcard do what’s called challenge-response authentication (in simple terms: get big long number, encode it with the key inside the smartchip, send encoded number out).

(Note that there are variants of the process were things like the amount of a transfer is added by the user to the input “big long number”).

That mechanism is the safest authentication method of all because the authentication key inside the smartchip in the bank card never leaves it and even the user PIN never gets provided to anything but that smartchip.

That means it can’t be eavesdropped over the network, nor can it be captured in the user’s PC (for example by a keylogger), so even people who execute files received on their e-mails or install any random software from the Internet on their PCs are safe from having their bank account authentication data captured by an attacker.

The far more common two-way-authentication edit: two-channel-authentication, aka two-factor-autentication (log in with a password, then get a number via SMS and enter it on the website to finalize authentication), whilst more secure that just username+password isn’t anywhere as safe as the method described above since GSM has security weaknesses and there are ways to redirected SMS messages to other devices.

(Source: amongst other things I worked in Smart Card Issuance software some years ago).

It’s funny that the original poster of this thread actually refuses to work with some banks because of them having the best and most secure bank access authentication in the industry, as it’s slightly inconvenient. Just another example of how, as it’s said in that domain, “users are the weakest link in IT Security”.