2 added 512 characters in body
source | link

You named it - it is a bank!

Banks are finance institutions and compare numbers and probabilities. We all know that a four digit!!!!! (not characters) password is absolutely insecure. Nevertheless the bank calculates the probability and costs of a user getting breached and the probability and costs for users forgetting their more complex app password and thus creating support requests.

There would be however one reason for using a real password on the app: The app on the smartphone stores a symmetric key to generate the one time password. You could use this password to encrypt this key, when it is not used. Again, we know that a four digit PIN will not create a good encryption key.

The device you linked with the key pad is probably a challenge response device? I assume you do not always enter the same PIN in the device!? The PIN is the challenge - it should contain some kind of information of the transaction. Your device also has a secret key and will create a response based on this challenge/transaction data. If it is implemented right, it is a rather strong mechanism. They could however have created this based on the OCRA algorithm (RFC6287 https://tools.ietf.org/html/rfc6287).

You named it - it is a bank!

Banks are finance institutions and compare numbers and probabilities. We all know that a four digit!!!!! (not characters) password is absolutely insecure. Nevertheless the bank calculates the probability and costs of a user getting breached and the probability and costs for users forgetting their more complex app password and thus creating support requests.

There would be however one reason for using a real password on the app: The app on the smartphone stores a symmetric key to generate the one time password. You could use this password to encrypt this key, when it is not used. Again, we know that a four digit PIN will not create a good encryption key.

You named it - it is a bank!

Banks are finance institutions and compare numbers and probabilities. We all know that a four digit!!!!! (not characters) password is absolutely insecure. Nevertheless the bank calculates the probability and costs of a user getting breached and the probability and costs for users forgetting their more complex app password and thus creating support requests.

There would be however one reason for using a real password on the app: The app on the smartphone stores a symmetric key to generate the one time password. You could use this password to encrypt this key, when it is not used. Again, we know that a four digit PIN will not create a good encryption key.

The device you linked with the key pad is probably a challenge response device? I assume you do not always enter the same PIN in the device!? The PIN is the challenge - it should contain some kind of information of the transaction. Your device also has a secret key and will create a response based on this challenge/transaction data. If it is implemented right, it is a rather strong mechanism. They could however have created this based on the OCRA algorithm (RFC6287 https://tools.ietf.org/html/rfc6287).

1
source | link

You named it - it is a bank!

Banks are finance institutions and compare numbers and probabilities. We all know that a four digit!!!!! (not characters) password is absolutely insecure. Nevertheless the bank calculates the probability and costs of a user getting breached and the probability and costs for users forgetting their more complex app password and thus creating support requests.

There would be however one reason for using a real password on the app: The app on the smartphone stores a symmetric key to generate the one time password. You could use this password to encrypt this key, when it is not used. Again, we know that a four digit PIN will not create a good encryption key.