Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When calling my bank, they require you to input your username and password using the phone keypad. Is this a safe practice? Specifically, is this less secure than inputting my password on their website?
As keypad buttons don't map 1:1 with ASCII characters, a potential eavesdropper wouldn't have my exact password, but would have a significantly reduced guessing space.
Is this a safe practice?
No, absolutely not.
Unlike internet traffic over HTTPS, phone lines are not encrypyted. In theory, nothing is preventing HTTPS-style encryption, but the problem is that both devices need to be able to do that. Normal phones just can't do it. And unlike HTTPS, there is no single big solution that the whole world knows and accepts.
Note that GSM and later mobile phone protocols have some encryption, but a) it is not that secure, and b) in the usual case, the signal to the base station is encrypted, and then from the base station on it's plaintext again.
Also note that some few of the "big" lines between countries etc. are encrypted (ie. phone->telecom1 not encrypted, telecom1->telecom2 encrypted, telcom2->phone not encrypted), but sadly that's rather seldom.
What that means for practice? Either crack GSM, or more easy set up your own base station, or even more easy (but a bit dirty) dig a hole to get to a major transport cable. (Or, if you're a diva like some certain government agency who doesn't want to get dirty, ask the biggest phone/internet node on the continent to get own rooms in the network center.). Being a telecom employee is nice too....
The only positive aspect might be that most attackers focus on the internet and related devices (computers, mobile phones, ...), instead of old phone connections.
Specifically, is this less secure than inputting my password on their website?
Sure
As keypad buttons don't map 1:1 with ASCII characters
So what? Anyone listening for pressed phone keys knows that and can easily convert it
Anyone listening for pressed phone keys knows that and can easily convert it though. If I press 485625337653, you cannot convert that into my password. You can convert it into a range of possible passwords (as I acknowledge in my question).