Our bank used to issue code cards, with 72 passwords printed on them. To login to net bank we used to need to know:

  • Our bank account number (we have that written down)
  • A password we've picked. We were not supposed to tell that to anybody or write it down
  • One random (specified during login) code from the code card.

To confirm a transaction, we used to type in another password.

Code cards were phased out as being insecure, and instead of them Smart-ID app was promoted to authenticate.

If we use Smart-ID to login, now we have to:

  • Write/copy our bank account number
  • Enter PIN 1 (4 digits code, randomly generated on account creation, can be changed) on our Smart-ID app to authenticate

To authenticate a transaction, we need to enter PIN 2 (5 digits code).

Thought link to the description of the app would be relevant.

As far am I'm concerned, for attacker getting access to bank account once is enough. All the money is taken, user goes to bank to change whatever security settings they have - regardless, if it's code card or Smart ID pins. In my eyes, what has changed:

  • Attacker needs to learn two very short, digits-only passwords, instead of one user generated one
  • Attacker needs to get physical access to the phone with the app rather than the code card.

So the question is: how does using an app to authenticate improve security over using a code card?

  • One point would be that users are more likely to notice their phone going missing before an attacker can abuse the information - if they lose a card which they only use for online banking, it could take until they next need to use online banking for them to notice. If they lose their phone, it's just until they next want their phone to make a call or check social media... – Matthew Oct 2 '18 at 15:19
  • 1
    paper can be lost, or copied without evidence. – dandavis Oct 2 '18 at 15:36
  • I bet, many people will snap a photo of their card code using their phone ;-) . IMHO, the apps is try to solve logistic issue i.e. bank need to mail you the new/refresh card code, while it assume user will password protect their phone and guard it from stolen. It doesn't save anyone if the user partner install a spyware into the user smarphone to skim everything. – mootmoot Oct 2 '18 at 15:51
  • also think about what you mean by improve security, and what a bank might mean... they may be very different... – Rory Alsop Oct 2 '18 at 16:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.