5

A while ago my bank introduced an online banking app. This allowed me to quickly access my bank account and make payments right from my phone with the best experience. In order to gain access to the app you need to enter a 5 digit pin code.

enter image description here

This however didn't feel that secure to me. I'm an avid online banking user and I normally do it on my laptop via the normal website. In order to log in I need a username and password. When I make a payment I'm prompted to enter a so called TAN code. This code I can either get from a hard copy, a list of codes I could keep in a drawer at home. However, in order to stay mobile I enabled the option to have those codes send to me via text message. So I make a payment, I get a text message with a code, I enter the code on my laptop and the payment is made. The banking app also asks for a code, but now payments are made on the same device. People now only need my phone, the 5 digit pin and they're set to empty my bank account. In the old situation my phone could be used to access the online banking website and receive the text message with, but they would need an username AND a password in order to log in. Therefor I don't use the app.

Maybe I'm wrong in thinking a 5 digit pin is not as secure as an username and password combination, but it got me wondering: what is the most secure option out there that still scores high in usability? Or how should it be done?

3 Answers 3

2

A single factor authentication (usually with "something you know", commonly a password) is not especially secure.

For banking operations, it is common to use two-factor authentication methods with "something you know" and "something you have", traditionally a combination of a plastic card you have and a PIN you know. Older forms of online banking use TAN lists, and "something you have" is the paper list. Theoretically, it could be argued that a TAN is something you can know, but in practice, nobody carries a list of 100 TANs mapped to their running number in their head.

Newer online banking operations rely on the fact that most people have a smartphone, and use the smartphone as "something you have". Benny Skogberg described one way of doing it. What my bank does is to let me register a mobile number with them, then send an mTAN valid for a single transaction to this number via SMS. This can be more secure than a single-factor, but it is not foolproof.

The problem is as old as security itself: Two factors are always more hassle than a single factor, and lower usability. A single factor is not especially secure, and gets frequently broken when the thief has the right motivation (such as getting access to a bank account or to the mail inbox of a celebrity). There are hundreds of ways to implement proper two factor security, and most of them will have the same usability as your online-password-plus-TAN-paper-list. No variation for mobile can have a higher usability and still stay secure, per definition, because for a two-factor:

  • you need to have a physical item which cannot be duplicated. You have to have it with you whenever you want access.
  • you need to have an unguessable piece of information with high entropy AND it may not be written down or saved anywhere near your physical item.

So you will always have to deal with either the cognitive effort of remembering a long password, or carry around an encrypted note on a note-taking device different from the device you use as the "something I have" factor. Both versions are low in usability and high in security.

Examples of how modern almost-two-factor systems are insecure:

  • It becomes one-factor if the phone browser saves passwords, which is the default setting, or if there is a banking app which does not require a PIN when starting on a registered phone (which may be the case in Benny Skroberg's example - I did not get this detail). Imagine that a thief steals my phone, unlocks it by looking at the smudges my finger left on the touchscreen, and starts the browser. If my online banking site is in the history and the password is saved, the mTAN gets sent to the phone the thief is holding.

  • There were cases in Germany last year where fraudsters requested a second SIM card with the same phone number from the victim's mobile provider and had it delivered to their own address. They could then do online banking from the victim's account using a phone with this second SIM card as the "something I have" factor (they got the password through phishing, trojan horses and other common methods). This works because the mobile provider would accept a faxed request for a second SIM card without doing anything to ensure it came from the rightful owner of the mobile contract. The victims never got anything reimbursed, because the bank said the mobile provider is responsible and the mobile provider said the bank is responsible.

By the way, the old TAN-on-paper system would not be secure for mobile either, because if you carry around a list of TANs in your wallet, there is a high chance that whoever steals your phone will also get your wallet.

So sadly, if you want to have something reasonably secure, you will have to give up lots of usability. The banks seem to be willing to take a compromise in security instead.


Addition: there are actually three possible factors, not two. The third one is "something you are". While it is considered more secure, as it can't be duplicated the way "something you know" can, there are no commercially viable methods for using in in automated settings with today's technology. Some solutions have been wasting as a niche technology for years and might yet become widespread once they reach a maturity good enough for broad acceptance, the way tablet computers did. For example, I have seen fingerprint readers in the wild. But they are not only expensive, they are also not precise enough. Face recognition systems are also notorious for both false positives (hold up a printed photograph of your victim to the camera) and false negatives (imagine waking up with face swollen due to root canal infection and not being able to log in into the highly-secured-because-privacy-protecting system of your health care provider). Voice fingerprinting technologies are also easy to fool with recordings and will refuse you entry if you catch a severe cold. Currently, it requires a live person to confirm your identity by looking at your ID's picture. We are probably stuck with the other two factors for online banking for many more years, which is sad, because a thumbprint reader is much more usable than having to take care of a plastic card or a fob for one-time-token generation (which is the modern, secure version of paper list TANs).

1
  • 2
    Very nice answer. Just remember that anything connected to the internet never can be and never will be "foolproof". Jan 7, 2014 at 14:34
3

I don't know if the following solution is "the most secure option", but it is secure and useful.

Phone

It all starts with your phone, and your phone number. It has to be registered as yours and it needs to be registered in your bank. In order to register your phone number at the bank, you call them on the very same phone, and they ask you questions only you could know. What is your current balance on your transfer account, do you save anything in funds or stock? Which funds do you have? What is your Personal identification number? These things needs to be answered before you can add your phone at your bank.

Third Party Identity Provider

When your phone is registered and the Bank App is downloaded, you visit the bank website to download another application from the third party identity provider, Bank ID. This Bank ID identifies you and it identifies the bank. You can use this Bank ID on other banks as well, but it secures the identity of your identity to your bank. If this identity isn't provided, you're not allowed to enter the bank via the Bank App.

enter image description here Bank ID

Account Restrictions

You have the ability to set restrictions on movement on your account, which can only be updated monthly. You can allow movement in a certain part of the world/country. You can also set the allowance on amount transfer allowed via the Bank App to an external account. All set by you to make judgment fit for your profile. Internet payment option is also among the settings controled by you.

enter image description here Betala räkning is Pay Bill in english.

Unusual Movement Alert

Last summer we went to Mallorca, Spain for a one week well deserved all inclusive holliday. At first payment by the credit card, I got a call from the Bank 15 minutes later. "We have registered that your credit card have been used in Mallorca, Spain. It's outside your usual payment pattern, and we just want to make sure that you used your card there, and that it isn't an attempt to empty your account".

With this service all together I feel very safe using Desktop, App and Credit Card banking.

5
  • I like the idea of an unusual movement alert. I forgot they already use that for creditcard payments. Sometimes I transfer money I owe to somebody else so no location is indicated unless GPS is turned on, but the pattern could exist of more than just location. Bank accounts you transfer to frequently who are therefor 'trusted', the time of the day for I normally do it during breaks at work or in the evening or the amount that is being transfered. Now I just need my bank to get that smart. Jan 7, 2014 at 11:40
  • 1
    @Paul Well even with location services turned off, you have ranges of IP-addresses as well which identifies (on a large scale) where you are, on what network and if this is within your usual pattern. Or you move your funds to a bank already that smart :-) Jan 7, 2014 at 11:44
  • 1
    It's worth pointing out that -- at least in the UK -- you should NEVER EVER tell ANYONE your card PIN. Even your bank. Jan 7, 2014 at 12:07
  • @AndrewLeach This is true, World wide! Jan 7, 2014 at 12:13
  • 1
    @AndrewLeach same goes for passwords, but some people are cunning enough to find out what yours is. Jan 7, 2014 at 12:50
0

Deciding how complex technology works based on surface-level (interface) analysis is prone to yield outlandish findings. Particularly when it comes to security, as security mechanisms have a constraint whereby they ideally do not divulge their inner workings. So, you feel that a pin code is insecure - but you don't know what is happening under the hood, your assertion is at best based on probability involving guessing of 5 digits.

I architected and implemented one of the earlier pin code authentication mechanisms for a large bank's mobile app - in doing so I worked closely with the security team, who preferred the pin code mechanism (that had a lot more going on under the hood than you might think) over username/password authentication. Why? Because there was a lot more (crypto smarts) going on under the hood.

Now, using your approach, if you were advising another bank on how to achieve a similar pin code authentication mechanism and your advise is based purely off your analysis of the interface of another banking app: you will miss a lot of detail and could lead your client to implementing a naive solution (i.e. one that simply uses a 5 pin code as a unique secret to gain access to an account). That system will only be able to handle 2^5 Users and getting anywhere near that many users would make the probability of guessing a pin extremely high. It just doesn't work like that.

For an example of the multitude of things that can and should happen under the hood regarding authentication: https://security.stackexchange.com/a/13351/8846

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.