Online Banking Two-Factor Authentication Security [closed]

Question

Lets take a closer look if transaction authentication numbers (TANs), such as: mTAN, chipTAN and pushTAN fulfill the requirements of a secure two-factor authentication method.

description of each of them:

1. mTAN: The authentication number is sent to the customer’s phone via SMS.
2. chipTAN: The customer owns a special device where she inputs her bank card, scans a bar code from the bank’s website, and a freshly generated authentication number is shown on the small device screen.
3. pushTAN: The number is received by a special, separate application on the customer’s phone which is not the banking app.

I am interested in both mobile application banking and bank's web portal banking.

Here are my thoughts about them.

a) Mobile Application.

mTAN: In this case the attacker other than username/password attacker only needs to have access only to the mobile phone of the victim to achieve his goal. So the second factor authentication does not really add much security. Overall - Not so secure ?

chipTAN: In this case except the username/password attacker needs to physically have the mobile phone, tan generator device and the bank card of the victim for success, which adds basically three more security levels. So I think this one qualifies as a secure method?

pushTAN: Here again attacker needs to have access to the victim's phone, since the separate application is also installed on the same smartphone. So this is similarly (non)secure as the MTAN?

b) Bank's web portal:

mTAN: This is basically the same as the mobile application version of mTAN.

chipTAN: In this case attacker does not need to have access to the mobile phone, but only the username/password, tan generator device and the bank card. This one seems still secure for me.

pushTAN: I am not quite sure how to connect pushTAN and web portal based mobile banking, but attacker would have to have the username/password and also access to the mobile phone.

Basically my 'task' is to state if the above mentioned two-factor authentication methods are secure and if not to describe the attack.

Please correct me if I said anything wrong and I would appreciate if you could suggest me some attacks which can be successful against those methods.

Answer 1

Sounds a bit like homework to me (?)

Is mTAN two-factor authentication secure?

You don't get security by using a single technology or device. The question would have to be extended: Does it guarantee authentication under such-and-such conditions, with attackers having this much resources available? Security is a (relative) property of systems, not single components. Also, authentication is mostly a means to get security.

You could ask "does mTAN fulfill its purpose" , and the answer would be yes, since two factor authentication is supposed to make it necessary to provide two things (in this case, something you know and something you have) to authenticate yourself instead of just one (usually a password, eg something you know).

Two-factor authentication closes off some venues of attack, but its purpose isn't to make all attacks fail. Its just to raise the bar.

You can always find attacks against authentication schemes. Imagine you install the best lock ever designed on your apartment door and reinforce all the windows and walls. Is this secure? Not against someone willing to steal your key. Would it be better to provide your thumbprint? (something you are) Well, that can be defeated in various ways, the most brutal one looks like this: Your password gets tortured out of you and they cut off your thumb in the process. Bang, two factor authentication failed. It can fail with less fireworks, too: You can be forced by a judge to give up both factors, or tricked into providing both factors via social engineering, and so on.

So forget about an authentication method being secure in and of itself. Ask about how much effort it is to circumvent or break it. Your three TAN schemes will vary in which attacks are the most feasible, cheapest, inconspicious etc.