4

There are known good practices for password reset functionality from OWASP and other resources. On the other hand, I believe most of us agree that security questions are not user friendly, they either make users choose easily guessable answers to questions like "whats your favorite color?" or in case the user forgets the actual password, most likely he won't remember the security question either.

So we see many websites delivering password links via email, the login can also be enhanced with second factor authentication via email or text messages.

Threat Model

In our threat model, suppose we have a mobile payment application, and we want to protect the user in case his mobile phone is stolen or accessed via malicious actors. We assume that the mobile is broken into (there's no password set on the device), now if an attacker gains access to the device, most likely he also has access to the email address which is setup on the device, so he can request a password reset on installed applications and break into them, unless security questions are used but I'm against this solution because of aforementioned issues.

My question is, first, is this threat model valid, because I haven't seen it being taken into account in many mobile payment applications, and second, how hard would it be to protect against such attack scenario and what are the possible solutions since most of side channels (OTP, Text Message, Email) are setup on mobile devices.

Improve this question

4 Answers 4

Reset to default
1
  1. You could ask for details about the actions the user has performed in your app.

Example: Show users a list of 3 popular merchants in the region out of which only one is used regularly by the user. Ask the user to select the merchant he has regularly paid using your app.

  1. Options for trusted contacts like Facebook. The user can assign trusted friends or family members who will each receive a part of a recovery code if the user forgets the password.
Improve this answer
0

If the victim's device is not password protected, all the accounts linked to the email and/or phone number from that device could be compromised. This is because of a device that was not secured by the user. IMO user should be forced to set some form of authentication on the device because a lot of people lose their device or it gets stolen.

Maybe this scenario is not taken into account by applications because device security is not their responsibility, but application security, where all the effort goes.

But, to compensate for user's mistake of not securing her device, mobile applications could ask the user for her fingerprint or other biometric methods, when resetting password, login or any other sensitive actions, besides the actual password input. And it should be mandatory, in order to protect the user if she would lose her device. The downside of this is that not every device supports fingerprint yet.

Improve this answer
0

This is a very good use-case. Many accounts are compromised because of user ignorance. If a mobile phone, which contains all email and SMS access, is lost without protection (lock), I would recommend a payment company to set questions like (instead of secret questions)

Ask for user's Driving license number, Residential card number, etc.

But the requirement is the user should had already provided those non-guessable details. The chance of mobile and Driving License getting stolen together is less, so that the account is little more secure.

Improve this answer
2
  • 5
    Your specific examples are not always non-guessable in many countries or situations. Which leads to the question: what types of data are non-guessable? The answer to that has lead us to create secret questions like "favourite food/pet/teacher". So, because the user would have to provide this info at registration time, secret questions and the questions you want to ask ultimately become the same thing. And because the question you want to ask (government issued ID) expose the user to risk if mishandled, this is a high-risk, low-value approach.
    – schroeder ♦
    Apr 25, 2019 at 5:54
  • In that case ,not entire ID number is required,You can just collect last 4 or 5 digits,In favorite food,pet examples people tend to use common things which can be remembered easily.But in case of ID number which is more 10 digits long(say) collecting last 4 or 5 digits will not have much risk ,I believe.
    – Brown
    Apr 25, 2019 at 6:19
0

I will provide you with an example and hopefully this gives you some ideas on how to implement this. For the bank I am using, we don't even have passwords, but we have the following security mechanism:

Components: - Bank application - Smart ID application - 4-digit PIN code known only by the user

When I am opening the bank app, I receive a request from the Smart ID to input my first pin code. This PIN code is only known to me, so even if my phone gets stolen, the attacker can't really make sense of it. On the other hand, if someone is trying to compromise me remotely, without my phone, I basically have a 2FA authentication.

Note, that I am not recommending this specific product, but giving you a workflow example which you could use.

Here's the documentation: https://github.com/SK-EID/smart-id-documentation

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .