1

My bank is a bit behind on their security protocol and they are finally initiating 2-step authentication for their online banking services. However, an authentication code can be sent only by text message, phone call, or email. I'm disappointed they will not permit the use of an authentication app, but it appears they have decided to forego this option, at least for now. Given the 3 options (text message, phone call, email), which is most secure when receiving authentication codes?

1

Are you in Canada or something? Multi factor authentication has been required in the United States since 2006 for all banks.

Any out of bank authentication (email, SMS, and voice) is fine and are roughly equal. The codes they use are single use and expire within a short amount of time so there is no black market on which hackers can sell them.

If I were forced to rank them from least secure to most secure, I would list them as

  1. Email - Probably the easiest to intercept
  2. SMS - Could be recovered from your inbox somehow, I suppose
  3. Voice - Only works in real time and requires a human being to listen to it
3
  • I totally agree with @john, but just to add some more info regarding SMS based authentication - pcworld.com/article/3099961/security/…
    – Anurag
    Sep 6 '16 at 1:41
  • Thanks John! I'm in the US. My bank is a small local bank, not one of the large commercial banks. Still, it's unbelievable to me that they are just getting around to instituting 2 factor auth. I've been pestering them about this for at least 2 years. I assumed that SMS might be most convenient, but with the new NIST recommendations, I assume this method will be phased out, along with voice calls (for the same reason). Hopefully my bank will update their security protocols in the future and permit the use of authentication apps.
    – ryp
    Sep 6 '16 at 1:42
  • 1
    I think you are referring to an "authenticator" which is a mobile app or fob with a shared key and a rotating token. These are not common in the U.S. They are pretty common in Europe and Scandinavia has been using them since 1995. OOB SMS is a common and very good standard. Susprised to hear that your bank hasn't done MFA until now-- they must have been out of FDIC compliance this whole time.
    – John Wu
    Sep 6 '16 at 2:08
1

I'll begin by saying that none is perfect and each depend on different factors:

  • land line: If your land line is a copper connection to the node, that can make it fairly easily accessible to a hacker to tap. Otherwise the hacker would need physical access to your location to tap your line.
  • mobile phone call: Unless your phone has an open back-door, this is not reasonably feasible.
  • email: If it uses a secured connection (SSL), the only way it could normally (MITM being unlikely if well configured) be intercepted is if your device has an open back-door.
  • sms: These are nearly impossible to intercept and would therefore also require a back-door on your device.
3
  • I dislike SMS because you cannot tell if it is being sent encrypted or in plain text. If you have a rather old receiver (phone) that do not use the SIM for encryption of the SMS then your are always getting it in clear text. But the nasty part is that you may have a good device but happen to be talking to an outdated mobile phone station which can only send it in clear. I may be wrong, this is a comment based on 5 year old info.
    – grochmal
    Sep 6 '16 at 2:32
  • @techraf: So you're suggesting that the hacker would know that the user is on the site at that moment? Sep 6 '16 at 3:07
  • 1
    Oh, now I understand your point. I'll remove that part as it is irrelevant with that in mind. Sep 6 '16 at 4:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.