A renown online bank uses a phone dial login system (input your login and password via the phone dial pad). How secure is this communication against MitM and similar attacks?
Considering I recently read how many major telecommunication networks had backdoors in them I am considering this to be bad news.
With either rotary or touch tone dialing, if you can hear it then you know what was entered. The ticks/tones are designed to be unambiguous to the recipient.
So, any listener can recover the digits easily. Modern attackers will capture and analyze the audio, and the tones were designed to be distinctive to equipment from the 1970s/80s. Some old school phreakers can do it by ear.
All of the phone networks---POTS (landline), VoIP (internet), and SS7 (cellular)---networks have serious vulnerabilities. (Note there is a category link on that summary page.)
These security issues are on top of the fact that law enforcement, spy agencies, and corrupt employees/officials can tap the phone lines.
There is little security, and a lot of it is broken. Properly encrypted email is far more secure than standard phone calls.
As a general rule, phone- and SMS-based security processes are inadequate. They provide the appearance of security, but they will stop only low-effort or unskilled attackers (which, honestly, is the largest group of would-be attackers).
If someone targets you, they can get those credentials relatively easily. In this case, the biggest risk factor is the likelihood that you will be targeted. For most people, that risk is quite low.
