Lets take a closer look if transaction authentication numbers (TANs), such as: mTAN, chipTAN and pushTAN fulﬁll the requirements of a secure two-factor authentication method.
description of each of them:
- mTAN: The authentication number is sent to the customer’s phone via SMS.
- chipTAN: The customer owns a special device where she inputs her bank card, scans a bar code from the bank’s website, and a freshly generated authentication number is shown on the small device screen.
- pushTAN: The number is received by a special, separate application on the customer’s phone which is not the banking app.
I am interested in both mobile application banking and bank's web portal banking.
Here are my thoughts about them.
a) Mobile Application.
mTAN: In this case the attacker other than username/password attacker only needs to have access only to the mobile phone of the victim to achieve his goal. So the second factor authentication does not really add much security. Overall - Not so secure ?
chipTAN: In this case except the username/password attacker needs to physically have the mobile phone, tan generator device and the bank card of the victim for success, which adds basically three more security levels. So I think this one qualifies as a secure method?
pushTAN: Here again attacker needs to have access to the victim's phone, since the separate application is also installed on the same smartphone. So this is similarly (non)secure as the MTAN?
b) Bank's web portal:
mTAN: This is basically the same as the mobile application version of mTAN.
chipTAN: In this case attacker does not need to have access to the mobile phone, but only the username/password, tan generator device and the bank card. This one seems still secure for me.
pushTAN: I am not quite sure how to connect pushTAN and web portal based mobile banking, but attacker would have to have the username/password and also access to the mobile phone.
Basically my 'task' is to state if the above mentioned two-factor authentication methods are secure and if not to describe the attack.
Please correct me if I said anything wrong and I would appreciate if you could suggest me some attacks which can be successful against those methods.