3

I am using a e-banking portal from a major Swiss bank (let's call it "Bank"). Some month ago, a new solution for the processing of electronic billing (e-bill) was introduced.

The whole e-bill solution is provided by a third party (let's call it "Partner"). Its user-interface opens within a scrollable area of the e-banking portal.

Once I log in to the e-banking portal through my Banks website (on a private browser window), automatically I have access also to the interface of Partner, as such interface is part of the e-banking portal.

The workflow for paying a bill looks as follows:

  1. Partner signals me the presence of an e-bill in a distinct notification area of the e-banking portal.
  2. I open Partners interface, and approve the bill to be paid on date X.
  3. The approved bill will display in Partners interface, but not in Banks interface. From Banks point of view, the bill doesn't exist (yet).
  4. On day X, Partner will charge the bill to my account. From that point on, the bill will display on searches within Banks interface.

From a security point of view, such workflow leaves me perplex, for the following reasons:

  1. When I log in / log out on the server of Bank, automatically I am logged in / logged out also on the server of Partner.
  2. Partner can charge my account even when I am not logged in. Bank doesn't have any trace of which bills I have approved and which bills I haven't approved. Partner basically has the possibility to charge any amount to my account for whatever reason.
  3. All my interaction with the services are happening within a web application. This web-application needs to be connected to my Banks server as well as to Partner's server, since my Bank actually doesn't know which my interactions with Partner are. In such interactions, there are at least four components: a) Bank's front-end, b) Bank's back-end, c) Partner's front-end, d) Partner's back end (while c is integrated into a from a user-perspective). Such situation seems rather complex to me and hard to control from a security point of view.

(As a side note: while I "trust" my Bank, I don't necesarily trust Partner. Moreover, when I opened my e-banking access, I entered a written contract with my Bank. I do not have any written agrrement with Partner, I just had to "Accept the Terms" before getting access to the e-billing.)

EDIT 1: The access Partner has is much different than for example the one a credit card company has. My credit card company might be able to charge my account once per month, or send me a bill which I then approve. Through Partner instead, I might be receiving e-bills from dozens of companies (phone company, internet provider, tax office ...), so Partner will charge my account several times per month. I therefore need to check the charged amounts twice: the first time when I approve the bills, the second time when they are effectively charged to my account.

Here are my main questions:

  • Can the described user-interface and workflow actually be implemented in a secure way?
  • Doesn't the presence of a third-party massively increase the risk of fraud?

While it is evident that I can at any time contest a (fraudulent) transaction, I actually want to avoid situations in which such transactions can happen. I am asking these questions from a user-perspective. I am not a Security specialist, but rather a IT security enthusiast.

EDIT 2: At the same time, the focus of my question is not so much if I trust Partner, but if really at the basis the integration of a third-party application into an e-banking portal can safely be implemented, and if it doesn't inherently mean there's a much bigger attack surface for fraudulent third parties. It's not so much about "am I safe as a user", but much more about "can this be considered best practice? Is this a safe way to manage things?" This brings me to a third (partial) question:

  • Given that Partner is running an application which is completely distinct from the Banks application, shouldn't Partner have a distinct login mechanism? Is this a "user-friendliness vs. security" tradeoff, or can the whole mechanism be "safely" (= as "safe" as e-banking can be) managed?
5
  • 1
    Do you trust the third party less than your bank? In my experience these kinds of partners often have better security than major banks.
    – paj28
    Aug 13, 2020 at 15:27
  • @paj28 I choose my bank. But I don't have any choice about third parties which may provide a service to my bank. Also, I have a direct contractual relationship with my bank, but not with my third party. Third, I have a long-standing relationship with my bank, but not with the third party.
    – 1NN
    Aug 13, 2020 at 15:41
  • 1
    @1NN Is this really any different from Visa, Mastercard, payment clearing houses and the many entities your bank contracts with? Aug 13, 2020 at 16:58
  • @user1937198 yes. My credit card company can't directly charge my account, but will send me a bill. Furthermore, I might be receiving e-bills from dozens of companies (phone company, internet provider, tax office ...), so Partner will charge my account several times per month. Also, the focus of my question is not so much if I trust Partner, but if really at the basis the integration of a third-party application into an e-banking portal can safely be implemented, and if it doesn't inherently mean there's a much bigger attack surface for fraudulent third parties. I'll integrate this into the Q
    – 1NN
    Aug 13, 2020 at 17:08
  • This is no different than any other service where you store your payment details and then give them permission to bill you. The only difference is that, since it is integrated directly with your bank account, you don't have to give them your account details. Just pretend that you stored your bank account in their system and then once a month (or however often) were saying, "Please pay my bill". Conceptually, that would be no different than the way things are working now. Aug 13, 2020 at 18:00

2 Answers 2

2

Let's answer your main question then:

Yes, this can be done securely.

Then let's answer the obvious followup question:

No, there is no way to tell if this is done securely

This certainly can be done securely - there are a wide variety of ways for you to sign in to one site and also be securely signed into another. This is the nature of SSO, which is actually a great way of doing things in many cases. The other items you are asking about can also be done well. However, it is not possible for us to tell whether or not things are being done securely. Most likely only the bank and the third party vendor could answer that question.

There is simply far too much involved for anyone to be able to say more than, "Yes, this can be done securely".

1

Sounds more like a rant than a question, so brief answer.

Session tokens can be passed securely between sites. Sometimes done with redirects and tokens in URL. Cross origin resource sharing (CORS) is a newer browser feature designed for this. Some sites use this for compartmentalization, e.g. photos.foo.com is separate from email.foo.com so if photos has an XSS flaw it can't affect email.

All large companies do some level of outsourcing. Typically not visible to the consumer, but this is an example where it is visible. In most jurisdictions the parent company remains responsible for failures at outsourcers.

There will be technical controls in place that you can't see, such as logging. Nothing you've mentioned would stop me using that bank.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .