Can a third-party service within an e-banking portal actually be safe?

Question

I am using a e-banking portal from a major Swiss bank (let's call it "Bank"). Some month ago, a new solution for the processing of electronic billing (e-bill) was introduced.

The whole e-bill solution is provided by a third party (let's call it "Partner"). Its user-interface opens within a scrollable area of the e-banking portal.

Once I log in to the e-banking portal through my Banks website (on a private browser window), automatically I have access also to the interface of Partner, as such interface is part of the e-banking portal.

The workflow for paying a bill looks as follows:

1. Partner signals me the presence of an e-bill in a distinct notification area of the e-banking portal.
2. I open Partners interface, and approve the bill to be paid on date X.
3. The approved bill will display in Partners interface, but not in Banks interface. From Banks point of view, the bill doesn't exist (yet).
4. On day X, Partner will charge the bill to my account. From that point on, the bill will display on searches within Banks interface.

From a security point of view, such workflow leaves me perplex, for the following reasons:

1. When I log in / log out on the server of Bank, automatically I am logged in / logged out also on the server of Partner.
2. Partner can charge my account even when I am not logged in. Bank doesn't have any trace of which bills I have approved and which bills I haven't approved. Partner basically has the possibility to charge any amount to my account for whatever reason.
3. All my interaction with the services are happening within a web application. This web-application needs to be connected to my Banks server as well as to Partner's server, since my Bank actually doesn't know which my interactions with Partner are. In such interactions, there are at least four components: a) Bank's front-end, b) Bank's back-end, c) Partner's front-end, d) Partner's back end (while c is integrated into a from a user-perspective). Such situation seems rather complex to me and hard to control from a security point of view.

(As a side note: while I "trust" my Bank, I don't necesarily trust Partner. Moreover, when I opened my e-banking access, I entered a written contract with my Bank. I do not have any written agrrement with Partner, I just had to "Accept the Terms" before getting access to the e-billing.)

EDIT 1: The access Partner has is much different than for example the one a credit card company has. My credit card company might be able to charge my account once per month, or send me a bill which I then approve. Through Partner instead, I might be receiving e-bills from dozens of companies (phone company, internet provider, tax office ...), so Partner will charge my account several times per month. I therefore need to check the charged amounts twice: the first time when I approve the bills, the second time when they are effectively charged to my account.

Here are my main questions:

• Can the described user-interface and workflow actually be implemented in a secure way?
• Doesn't the presence of a third-party massively increase the risk of fraud?

While it is evident that I can at any time contest a (fraudulent) transaction, I actually want to avoid situations in which such transactions can happen. I am asking these questions from a user-perspective. I am not a Security specialist, but rather a IT security enthusiast.

EDIT 2: At the same time, the focus of my question is not so much if I trust Partner, but if really at the basis the integration of a third-party application into an e-banking portal can safely be implemented, and if it doesn't inherently mean there's a much bigger attack surface for fraudulent third parties. It's not so much about "am I safe as a user", but much more about "can this be considered best practice? Is this a safe way to manage things?" This brings me to a third (partial) question:

• Given that Partner is running an application which is completely distinct from the Banks application, shouldn't Partner have a distinct login mechanism? Is this a "user-friendliness vs. security" tradeoff, or can the whole mechanism be "safely" (= as "safe" as e-banking can be) managed?

Answer 1

Let's answer your main question then:

Yes, this can be done securely.

Then let's answer the obvious followup question:

No, there is no way to tell if this is done securely

This certainly can be done securely - there are a wide variety of ways for you to sign in to one site and also be securely signed into another. This is the nature of SSO, which is actually a great way of doing things in many cases. The other items you are asking about can also be done well. However, it is not possible for us to tell whether or not things are being done securely. Most likely only the bank and the third party vendor could answer that question.

There is simply far too much involved for anyone to be able to say more than, "Yes, this can be done securely".

Answer 2

Sounds more like a rant than a question, so brief answer.

Session tokens can be passed securely between sites. Sometimes done with redirects and tokens in URL. Cross origin resource sharing (CORS) is a newer browser feature designed for this. Some sites use this for compartmentalization, e.g. photos.foo.com is separate from email.foo.com so if photos has an XSS flaw it can't affect email.

All large companies do some level of outsourcing. Typically not visible to the consumer, but this is an example where it is visible. In most jurisdictions the parent company remains responsible for failures at outsourcers.

There will be technical controls in place that you can't see, such as logging. Nothing you've mentioned would stop me using that bank.