5

When calling my bank, they require you to input your username and password using the phone keypad. Is this a safe practice? Specifically, is this less secure than inputting my password on their website?

As keypad buttons don't map 1:1 with ASCII characters, a potential eavesdropper wouldn't have my exact password, but would have a significantly reduced guessing space.

  • 2
    I'd be much more concerned that this means they are storing your password insecurely in their systems. There are definitely safe ways of doing that, but there are much easier ways of doing it that are terribly insecure. – Moshe Katz Sep 4 '17 at 0:10
9

Is this a safe practice?

No, absolutely not.

Unlike internet traffic over HTTPS, phone lines are not encrypyted. In theory, nothing is preventing HTTPS-style encryption, but the problem is that both devices need to be able to do that. Normal phones just can't do it. And unlike HTTPS, there is no single big solution that the whole world knows and accepts.

Note that GSM and later mobile phone protocols have some encryption, but a) it is not that secure, and b) in the usual case, the signal to the base station is encrypted, and then from the base station on it's plaintext again.

Also note that some few of the "big" lines between countries etc. are encrypted (ie. phone->telecom1 not encrypted, telecom1->telecom2 encrypted, telcom2->phone not encrypted), but sadly that's rather seldom.

What that means for practice? Either crack GSM, or more easy set up your own base station, or even more easy (but a bit dirty) dig a hole to get to a major transport cable. (Or, if you're a diva like some certain government agency who doesn't want to get dirty, ask the biggest phone/internet node on the continent to get own rooms in the network center.). Being a telecom employee is nice too....

The only positive aspect might be that most attackers focus on the internet and related devices (computers, mobile phones, ...), instead of old phone connections.

Specifically, is this less secure than inputting my password on their website?

Sure

As keypad buttons don't map 1:1 with ASCII characters

So what? Anyone listening for pressed phone keys knows that and can easily convert it

  • 1
    Good answer, I was about to also mention: whenever an attacker has the phone call and numbers, they can easily impersonate the victim via a phone call, so the exact password is not even necessary – Tobi Nary Sep 2 '17 at 21:43
  • 1
    Thanks, good answer. I wouldn't say Anyone listening for pressed phone keys knows that and can easily convert it though. If I press 485625337653, you cannot convert that into my password. You can convert it into a range of possible passwords (as I acknowledge in my question). – rcorre Sep 4 '17 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.