Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

A while ago my bank introduced an online banking app. This allowed me to quickly access my bank account and make payments right from my phone with the best experience. In order to gain access to the app you need to enter a 5 digit pin code.

enter image description here

This however didn't feel that secure to me. I'm an avid online banking user and I normally do it on my laptop via the normal website. In order to log in I need a username and password. When I make a payment I'm prompted to enter a so called TAN code. This code I can either get from a hard copy, a list of codes I could keep in a drawer at home. However, in order to stay mobile I enabled the option to have those codes send to me via text message. So I make a payment, I get a text message with a code, I enter the code on my laptop and the payment is made. The banking app also asks for a code, but now payments are made on the same device. People now only need my phone, the 5 digit pin and they're set to empty my bank account. In the old situation my phone could be used to access the online banking website and receive the text message with, but they would need an username AND a password in order to log in. Therefor I don't use the app.

Maybe I'm wrong in thinking a 5 digit pin is not as secure as an username and password combination, but it got me wondering: what is the most secure option out there that still scores high in usability? Or how should it be done?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

A single factor authentication (usually with "something you know", commonly a password) is not especially secure.

For banking operations, it is common to use two-factor authentication methods with "something you know" and "something you have", traditionally a combination of a plastic card you have and a PIN you know. Older forms of online banking use TAN lists, and "something you have" is the paper list. Theoretically, it could be argued that a TAN is something you can know, but in practice, nobody carries a list of 100 TANs mapped to their running number in their head.

Newer online banking operations rely on the fact that most people have a smartphone, and use the smartphone as "something you have". Benny Skogberg described one way of doing it. What my bank does is to let me register a mobile number with them, then send an mTAN valid for a single transaction to this number via SMS. This can be more secure than a single-factor, but it is not foolproof.

The problem is as old as security itself: Two factors are always more hassle than a single factor, and lower usability. A single factor is not especially secure, and gets frequently broken when the thief has the right motivation (such as getting access to a bank account or to the mail inbox of a celebrity). There are hundreds of ways to implement proper two factor security, and most of them will have the same usability as your online-password-plus-TAN-paper-list. No variation for mobile can have a higher usability and still stay secure, per definition, because for a two-factor:

  • you need to have a physical item which cannot be duplicated. You have to have it with you whenever you want access.
  • you need to have an unguessable piece of information with high entropy AND it may not be written down or saved anywhere near your physical item.

So you will always have to deal with either the cognitive effort of remembering a long password, or carry around an encrypted note on a note-taking device different from the device you use as the "something I have" factor. Both versions are low in usability and high in security.

Examples of how modern almost-two-factor systems are insecure:

  • It becomes one-factor if the phone browser saves passwords, which is the default setting, or if there is a banking app which does not require a PIN when starting on a registered phone (which may be the case in Benny Skroberg's example - I did not get this detail). Imagine that a thief steals my phone, unlocks it by looking at the smudges my finger left on the touchscreen, and starts the browser. If my online banking site is in the history and the password is saved, the mTAN gets sent to the phone the thief is holding.

  • There were cases in Germany last year where fraudsters requested a second SIM card with the same phone number from the victim's mobile provider and had it delivered to their own address. They could then do online banking from the victim's account using a phone with this second SIM card as the "something I have" factor (they got the password through phishing, trojan horses and other common methods). This works because the mobile provider would accept a faxed request for a second SIM card without doing anything to ensure it came from the rightful owner of the mobile contract. The victims never got anything reimbursed, because the bank said the mobile provider is responsible and the mobile provider said the bank is responsible.

By the way, the old TAN-on-paper system would not be secure for mobile either, because if you carry around a list of TANs in your wallet, there is a high chance that whoever steals your phone will also get your wallet.

So sadly, if you want to have something reasonably secure, you will have to give up lots of usability. The banks seem to be willing to take a compromise in security instead.


Addition: there are actually three possible factors, not two. The third one is "something you are". While it is considered more secure, as it can't be duplicated the way "something you know" can, there are no commercially viable methods for using in in automated settings with today's technology. Some solutions have been wasting as a niche technology for years and might yet become widespread once they reach a maturity good enough for broad acceptance, the way tablet computers did. For example, I have seen fingerprint readers in the wild. But they are not only expensive, they are also not precise enough. Face recognition systems are also notorious for both false positives (hold up a printed photograph of your victim to the camera) and false negatives (imagine waking up with face swollen due to root canal infection and not being able to log in into the highly-secured-because-privacy-protecting system of your health care provider). Voice fingerprinting technologies are also easy to fool with recordings and will refuse you entry if you catch a severe cold. Currently, it requires a live person to confirm your identity by looking at your ID's picture. We are probably stuck with the other two factors for online banking for many more years, which is sad, because a thumbprint reader is much more usable than having to take care of a plastic card or a fob for one-time-token generation (which is the modern, secure version of paper list TANs).

share|improve this answer
2  
Very nice answer. Just remember that anything connected to the internet never can be and never will be "foolproof". –  Benny Skogberg MCSA Jan 7 at 14:34

I don't know if the following solution is "the most secure option", but it is secure and useful.

Phone

It all starts with your phone, and your phone number. It has to be registered as yours and it needs to be registered in your bank. In order to register your phone number at the bank, you call them on the very same phone, and they ask you questions only you could know. What is your current balance on your transfer account, do you save anything in funds or stock? Which funds do you have? What is your Personal identification number? These things needs to be answered before you can add your phone at your bank.

Third Party Identity Provider

When your phone is registered and the Bank App is downloaded, you visit the bank website to download another application from the third party identity provider, Bank ID. This Bank ID identifies you and it identifies the bank. You can use this Bank ID on other banks as well, but it secures the identity of your identity to your bank. If this identity isn't provided, you're not allowed to enter the bank via the Bank App.

enter image description here Bank ID

Account Restrictions

You have the ability to set restrictions on movement on your account, which can only be updated monthly. You can allow movement in a certain part of the world/country. You can also set the allowance on amount transfer allowed via the Bank App to an external account. All set by you to make judgment fit for your profile. Internet payment option is also among the settings controled by you.

enter image description here Betala räkning is Pay Bill in english.

Unusual Movement Alert

Last summer we went to Mallorca, Spain for a one week well deserved all inclusive holliday. At first payment by the credit card, I got a call from the Bank 15 minutes later. "We have registered that your credit card have been used in Mallorca, Spain. It's outside your usual payment pattern, and we just want to make sure that you used your card there, and that it isn't an attempt to empty your account".

With this service all together I feel very safe using Desktop, App and Credit Card banking.

share|improve this answer
    
I like the idea of an unusual movement alert. I forgot they already use that for creditcard payments. Sometimes I transfer money I owe to somebody else so no location is indicated unless GPS is turned on, but the pattern could exist of more than just location. Bank accounts you transfer to frequently who are therefor 'trusted', the time of the day for I normally do it during breaks at work or in the evening or the amount that is being transfered. Now I just need my bank to get that smart. –  Paul Jan 7 at 11:40
1  
@Paul Well even with location services turned off, you have ranges of IP-addresses as well which identifies (on a large scale) where you are, on what network and if this is within your usual pattern. Or you move your funds to a bank already that smart :-) –  Benny Skogberg MCSA Jan 7 at 11:44
1  
It's worth pointing out that -- at least in the UK -- you should NEVER EVER tell ANYONE your card PIN. Even your bank. –  Andrew Leach Jan 7 at 12:07
    
@AndrewLeach This is true, World wide! –  Benny Skogberg MCSA Jan 7 at 12:13
1  
@AndrewLeach same goes for passwords, but some people are cunning enough to find out what yours is. –  Paul Jan 7 at 12:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.