A single factor authentication (usually with "something you know", commonly a password) is not especially secure.
For banking operations, it is common to use two-factor authentication methods with "something you know" and "something you have", traditionally a combination of a plastic card you have and a PIN you know. Older forms of online banking use TAN lists, and "something you have" is the paper list. Theoretically, it could be argued that a TAN is something you can know, but in practice, nobody carries a list of 100 TANs mapped to their running number in their head.
Newer online banking operations rely on the fact that most people have a smartphone, and use the smartphone as "something you have". Benny Skogberg described one way of doing it. What my bank does is to let me register a mobile number with them, then send an mTAN valid for a single transaction to this number via SMS. This can be more secure than a single-factor, but it is not foolproof.
The problem is as old as security itself: Two factors are always more hassle than a single factor, and lower usability. A single factor is not especially secure, and gets frequently broken when the thief has the right motivation (such as getting access to a bank account or to the mail inbox of a celebrity). There are hundreds of ways to implement proper two factor security, and most of them will have the same usability as your online-password-plus-TAN-paper-list. No variation for mobile can have a higher usability and still stay secure, per definition, because for a two-factor:
- you need to have a physical item which cannot be duplicated. You have to have it with you whenever you want access.
- you need to have an unguessable piece of information with high entropy AND it may not be written down or saved anywhere near your physical item.
So you will always have to deal with either the cognitive effort of remembering a long password, or carry around an encrypted note on a note-taking device different from the device you use as the "something I have" factor. Both versions are low in usability and high in security.
Examples of how modern almost-two-factor systems are insecure:
It becomes one-factor if the phone browser saves passwords, which is the default setting, or if there is a banking app which does not require a PIN when starting on a registered phone (which may be the case in Benny Skroberg's example - I did not get this detail). Imagine that a thief steals my phone, unlocks it by looking at the smudges my finger left on the touchscreen, and starts the browser. If my online banking site is in the history and the password is saved, the mTAN gets sent to the phone the thief is holding.
There were cases in Germany last year where fraudsters requested a second SIM card with the same phone number from the victim's mobile provider and had it delivered to their own address. They could then do online banking from the victim's account using a phone with this second SIM card as the "something I have" factor (they got the password through phishing, trojan horses and other common methods). This works because the mobile provider would accept a faxed request for a second SIM card without doing anything to ensure it came from the rightful owner of the mobile contract. The victims never got anything reimbursed, because the bank said the mobile provider is responsible and the mobile provider said the bank is responsible.
By the way, the old TAN-on-paper system would not be secure for mobile either, because if you carry around a list of TANs in your wallet, there is a high chance that whoever steals your phone will also get your wallet.
So sadly, if you want to have something reasonably secure, you will have to give up lots of usability. The banks seem to be willing to take a compromise in security instead.
Addition: there are actually three possible factors, not two. The third one is "something you are". While it is considered more secure, as it can't be duplicated the way "something you know" can, there are no commercially viable methods for using in in automated settings with today's technology. Some solutions have been wasting as a niche technology for years and might yet become widespread once they reach a maturity good enough for broad acceptance, the way tablet computers did. For example, I have seen fingerprint readers in the wild. But they are not only expensive, they are also not precise enough. Face recognition systems are also notorious for both false positives (hold up a printed photograph of your victim to the camera) and false negatives (imagine waking up with face swollen due to root canal infection and not being able to log in into the highly-secured-because-privacy-protecting system of your health care provider). Voice fingerprinting technologies are also easy to fool with recordings and will refuse you entry if you catch a severe cold. Currently, it requires a live person to confirm your identity by looking at your ID's picture. We are probably stuck with the other two factors for online banking for many more years, which is sad, because a thumbprint reader is much more usable than having to take care of a plastic card or a fob for one-time-token generation (which is the modern, secure version of paper list TANs).
Bank ID
Betala räkning is Pay Bill in english.
