On: Molly (Signal fork) has not been updated since 3 months and is vulnerable

[cocoto]

I’m pretty sure it’s for security reasons, it allows the app to ensure the code comes from a correct Signal phone number and not from a third party actor. It’s hand holding yes but it’s a trade off in favor of non-technical users.

[dist-epoch → cocoto]

Somehow all the other apps, including bank apps, do not seem to consider this necessary.

Signal always has excuses, "we can't add usernames because we don't know how to make them secure"

[Zak → dist-epoch]

Bank apps do checklist-oriented security, and nobody has put that on the checklist yet.

[SoftTalker → Zak]

Banks stand to lose actual money if they screw up. They do a bit more than checklists.

[dizhn → dist-epoch]

My one bank app makes me enable Play Store security. Another one makes me disable developer mode to use NFC payments.

[customguy → cocoto]

> it allows the app to ensure the code comes from a correct Signal phone number and not from a third party actor.

But if they sent you the code, even if a third party actor could somehow see it and hand it to you instead -- so what? What's the difference?