0

We are working on an online eCommerce site and we need to have online transactions. The common mechanism of verifying the online transaction seems the OTP (one Time Passwords) over SMS.

But this mechanisms is alarming as came across following vulnerability/exploit on SMS protocol.

https://attack.mitre.org/mobile/index.php/Technique/MOB-T1052

https://blog.easysol.net/ss7_sms_based_exploits/

***As per the second article even Telecoms have warned using SMS (insecure) for banking purpose.

Is there an alternative way of verifying online transaction through 'evolving mobile bio metric capabilities'?

Or Are there any other alternative we can adopt?

1

Biometrics are tricky for online transaction. The more feasible way would be to use something like TOTP. There is a variety of apps that support TOTP generation and it would be easy for you to distribute it (print out a QR code).

An even more secure but much more expensive alternative is to use physical tokens. I would strongly recommend to support them. While they are not feasible for everyone, you could at least support them for your security conscious customers (who have their own tokens) and possibly force them (provide a token) for premium customers who do large transactions regularly.

Also, invest in notifying your customers. A service where you send an sms or other notification about every transaction should be available (optional) and for suspicious (unusually large) transactions, they could be mandatory. Noticing a breach early could make it possible to stop the transaction before it goes through.

2
  • Anyone implemented it in real world scenarios...? – Sayan Sep 16 '18 at 11:26
  • @Sayan never heard about TOTP in banking apps but it is used widely everywhere else, from google through facebook, steam, down to some pretty small sites. I believe some hardware tokens were implemented for banking but am not sure about that. They are used less widely, but are implemented for Google and some other security sensitive web services. The reason for rarer implementations of HW tokens is that every user needs to buy a HW token ($30+), so in most applications, it is not justifiable even for the superb security they provide. – Peter Harmann Sep 16 '18 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.