Lets take a closer look if transaction authentication numbers (TANs), such as: mTAN, chipTAN and pushTAN fulfill the requirements of a secure two-factor authentication method.

description of each of them:

  1. mTAN: The authentication number is sent to the customer’s phone via SMS.
  2. chipTAN: The customer owns a special device where she inputs her bank card, scans a bar code from the bank’s website, and a freshly generated authentication number is shown on the small device screen.
  3. pushTAN: The number is received by a special, separate application on the customer’s phone which is not the banking app.

I am interested in both mobile application banking and bank's web portal banking.

Here are my thoughts about them.

a) Mobile Application.

mTAN: In this case the attacker other than username/password attacker only needs to have access only to the mobile phone of the victim to achieve his goal. So the second factor authentication does not really add much security. Overall - Not so secure ?

chipTAN: In this case except the username/password attacker needs to physically have the mobile phone, tan generator device and the bank card of the victim for success, which adds basically three more security levels. So I think this one qualifies as a secure method?

pushTAN: Here again attacker needs to have access to the victim's phone, since the separate application is also installed on the same smartphone. So this is similarly (non)secure as the MTAN?

b) Bank's web portal:

mTAN: This is basically the same as the mobile application version of mTAN.

chipTAN: In this case attacker does not need to have access to the mobile phone, but only the username/password, tan generator device and the bank card. This one seems still secure for me.

pushTAN: I am not quite sure how to connect pushTAN and web portal based mobile banking, but attacker would have to have the username/password and also access to the mobile phone.

Basically my 'task' is to state if the above mentioned two-factor authentication methods are secure and if not to describe the attack.

Please correct me if I said anything wrong and I would appreciate if you could suggest me some attacks which can be successful against those methods.

  • 3
    Your question currently seems to ask "what are your thoughts on the security of these systems", which is a bit off-topic for security Stack Exchange. Instead, try to ask a specific question. – Sjoerd Nov 17 '16 at 11:24
  • @Sjoerd if I ask: 'Is mTAN two-factor authentication method secure? if not, why? ' would this be better ? – Leonardo Nov 17 '16 at 11:27
  • 1
    @Leonardo that would be better, but still rather vague - "secure" could be more specific. Or perhaps you are asking for the specifics - e.g. "what would be a valid threat model for mTAN etc"... – AviD Nov 17 '16 at 12:22

Sounds a bit like homework to me (?)

Is mTAN two-factor authentication secure?

You don't get security by using a single technology or device. The question would have to be extended: Does it guarantee authentication under such-and-such conditions, with attackers having this much resources available? Security is a (relative) property of systems, not single components. Also, authentication is mostly a means to get security.

You could ask "does mTAN fulfill its purpose" , and the answer would be yes, since two factor authentication is supposed to make it necessary to provide two things (in this case, something you know and something you have) to authenticate yourself instead of just one (usually a password, eg something you know).

Two-factor authentication closes off some venues of attack, but its purpose isn't to make all attacks fail. Its just to raise the bar.

You can always find attacks against authentication schemes. Imagine you install the best lock ever designed on your apartment door and reinforce all the windows and walls. Is this secure? Not against someone willing to steal your key. Would it be better to provide your thumbprint? (something you are) Well, that can be defeated in various ways, the most brutal one looks like this: Your password gets tortured out of you and they cut off your thumb in the process. Bang, two factor authentication failed. It can fail with less fireworks, too: You can be forced by a judge to give up both factors, or tricked into providing both factors via social engineering, and so on.

So forget about an authentication method being secure in and of itself. Ask about how much effort it is to circumvent or break it. Your three TAN schemes will vary in which attacks are the most feasible, cheapest, inconspicious etc.

|improve this answer|||||
  • it's not exactly homework, more like a bunch of exercises to practice for the tests. thanks for the answer, I think I understand what you mean. But that raises other question for me, cutting somebody's thumb doesn't really sound like a cyber attack to me. So, in terms of cyber security the chipTAN for example is considered to be secure, because attacker can only be successful if he, say steals the device and bank card. – Leonardo Nov 17 '16 at 16:00
  • No, it isn't, but like I said, security can't be reduced to technological solutions. If you only look to technology to solve a problem and ignore people and how they behave, you're in trouble. Here's a nice illustration: xkcd.com/538. That said, note how two-factor authentication tries to take authentication out of the purely virtual/digital world; it's harder for a hacker sitting in Sierra Leone to get at your bank account if he not only needs to enter a password, but also needs to figure out a way to access a number displayed on a physical device in your possession. – Out of Band Nov 17 '16 at 16:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.