Our bank used to issue code cards, with 72 passwords printed on them. To login to net bank we used to need to know:
- Our bank account number (we have that written down)
- A password we've picked. We were not supposed to tell that to anybody or write it down
- One random (specified during login) code from the code card.
To confirm a transaction, we used to type in another password.
Code cards were phased out as being insecure, and instead of them Smart-ID app was promoted to authenticate.
If we use Smart-ID to login, now we have to:
- Write/copy our bank account number
- Enter PIN 1 (4 digits code, randomly generated on account creation, can be changed) on our Smart-ID app to authenticate
To authenticate a transaction, we need to enter PIN 2 (5 digits code).
Thought link to the description of the app would be relevant.
As far am I'm concerned, for attacker getting access to bank account once is enough. All the money is taken, user goes to bank to change whatever security settings they have - regardless, if it's code card or Smart ID pins. In my eyes, what has changed:
- Attacker needs to learn two very short, digits-only passwords, instead of one user generated one
- Attacker needs to get physical access to the phone with the app rather than the code card.
So the question is: how does using an app to authenticate improve security over using a code card?