1

I have a bank account in one of the main European banks. The bank recently overhauled its online banking system, making it more visually attractive (and also full of bugs and extremely annoying to use).

One of the changes is that the bank now requires my a PIN every time I do an online transaction: they call you on the phone and you have to enter the PIN. By default this PIN is the same as that of the ATM card, I do not know if it can be changed.

How is this advantageous compared to the previous setup, which was similarly a two-factor authentication protocol via phone, but with a One Time Password? I thought this method was secure and reliable. Repeatedly inserting the ATM PIN on the phone for every transaction does not look secure to me: this looks like a regression, not an improvement. Am I wrong?

  • There are some questions regarding PINs and online banking setups. I advice you look these up and see if any of them answer your question. Short answer here: it's a major deterioration. – Tom K. Jan 18 '18 at 9:26
1

Its not necessarily a more secure.

The bank is not just concerned about security - but the cost associated with it. If using this protocol means 2% more customers are compromised but its 10% cheaper to implement or results in 10% less customers calling in because they can't understand what they are supposed to do then it may be economically beneficial to the bank to choose the less secure implementation. For example for the less computer literate typing in a code at the speed its read may be a struggle.

Repeatedly inserting the ATM PIN on the phone for every transaction does not look secure to me

To abuse this system an attacker needs control of your phone line, either wire access to the line as you are using it or knowledge of the pin value and access to an authenticated online session. I'd argue that has a fairly high level of security - its usually much easier to abuse telephone banking.

  • Costs should be the same - they called you before, they call you now. The costs in support really should be minimal, I'd say. The difference is that if your phone was compromised before, you lost your OTP only, which is worthless. If it is now, you lost the ATM PIN, which is far more valuable. As a hacker, you do not necessarily need to intercept the call, you just need a logger on the used (smart)phone. – AF7 Jan 18 '18 at 9:21
  • @AF7 - before they had to have dedicated code to generate a OTP hooked into both the website and the phone handling systems. Now they can use the same pin verification calls they need for other internal functionality. If your phone is compromised electronically then without physical access to the card (or an online banking session now..) the pin is usually worthless. If its compromised physically odds are they have physical access to the card anyway. A OTP is technically more secure - but the actual impact on fraud as a result of the change is likely to be negligible. – Hector Jan 18 '18 at 9:25
  • I agree the system is still pretty secure. I'm not really worried about that. They would have to steal my wallet, my phone, my laptop AND my encryption key to access all the information they need to do bank transfers in my place. But I would expect that from a system "upgrade" security should never decrease, and I was surprised to see this change. I was wandering if maybe I was wrong and I was missing something. – AF7 Jan 18 '18 at 9:32
  • @AF7 - I expect either this back-end is cheaper (as described above) or they get a high number of calls from people that couldn't work the OTP system - never underestimate a users ability to screw it up. – Hector Jan 18 '18 at 9:36
0

It is clearly less secure. Even if eavesdropped, one time passwords are generally "consumed" by the time a third party has a chance to use them. Plus, to capture them by a man-in-the-middle attack, one needs to run a more elaborate system as compared to capturing the PIN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.