Postbank will deactivate two-factor authentication via SMS-TAN in August. You are henceforth to instead provide an authentication password, optionally unlockable via (unspecified) biometry. One password thus authenticates all transactions. Everything is much better and more secure.

Now of course, we may assume that the experts inventing this system are not complete idiots. So obviously there's something that I'm not understanding.

What exactly is the advantage of a password that is indefinitively stored in some form (hopefully hashed in some way) on the server and stored (hopefully encrypted, but necessarily decryptable) on an easily-stolen device over a unique number that is generated on the fly, valid for exactly one given transaction, and expires within five minutes?


1 Answer 1


If your device is compromised (or “easily stolen”), SMS authentication is just as useless because an attacker can just read the message. The advantage of storing an encrypted password is that it’s hard to access (especially with biometrics), compared to text messages which can by default be read even on a locked screen.

  • The "locked screen" part is especially interesting.
    – Qortex
    Jun 1, 2019 at 13:33
  • Also, critically, SMS senders can be spoofed. Jun 1, 2019 at 14:33
  • 1
    Well, the thing with "easily stolen" is that it doesn't matter with SMS. You are only sent an SMS after starting the transaction, and the TAN within is valid only for that transaction, and expires quickly. The stolen phone is worthless otherwise, it would have to be stolen during that one minute, while I'm at home. Not so if my password is stored in there as kinda has to be the case if I can "unlock" transactions with faceid or fingerprint. Plus, it has the app that upon opening lets you start a transaction right away (with account details needed etc).
    – Damon
    Jun 1, 2019 at 16:18
  • 1
    @securityOrange: Not an issue. Neither eavesdropping nor spoofing is an issue. The contents of the SMS are worthless as they are valid for an already-defined transaction only. An invalid code does nothing but trigger "Wrong code, please enter again!" in the web form. So eavesdrop and spoof away all you want, it's just worthless.
    – Damon
    Jun 1, 2019 at 16:20
  • @Damon oh yeah, that’s true. Good point. Thanks for pointing that out! Jun 1, 2019 at 17:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .