Sure, but I’m not talking abuot whitelabelling. I’m talking about my bank telling me “go to the Play Store and download Symantec VIP”. An app that just does TOTP, but in a way that doesn’t enable you to use your own preferred TOTP app instead (without some rather difficult hacks).

Like I said, if they were using an app that provided more functionality than TOTP, I wouldn’t mind too much. If they were using an app that allowed them to put in their own branding, I’d be annoyed but at least “get it”. What I’m getting here is the worst of both worlds.

Good MFA is harder than people think.

Believe me, I know. At my former workplace, I was one of the leading engineers on a project to make our product support MFA. The business folks wanted it built into our existing app (for marketing reasons) and wanted push notifications, not TOTP. Three times we were working on that project, had given estimates for time to finish and had even made some substantial progress in implementing it, when business priorities shifted and the work got scrapped in favour of something unrelated, eventually coming back to it with a scope that was just different enough that most of the work already done couldn’t be reused. I’ve spent a lot of time looking at MFA from a software engineer’s perspective.