0

Recently I had more or less the same discussion with the helpdesk of several banks; a bank has a new mobile app that allows logging in without sending an SMS and without asking a confirmation code by the PIN Sentry/smartcard reader. The discussion is on the following lines:

Q: All your login procedure is in a single mobile app, why did you ditch the two factor authentication?
H: Our app still has two factor authentication
Q: But a login in two steps on the same channnel is still a login through a single channel
H: different answers, but all with arguments in circle that say nothing

Eventually I never had an answer. So I would like to know why a login, which might be in two steps or not, via a mobile app, but without SMS or chipcard is considered a two factor authentication.

Update: I do not think this question is a duplicate of the question asking if the two factor authentication gives a false sense of security

Proposing that as a duplicate is like stating that since the two factor authentication is not enough we can ditch it altogether thus further reducing the security.

Improve this question
10
  • 3
    The first factor is your password. The second factor is the possession of your device. Possession of the device can be established via many means, e.g. SMS, push notifications, or issuance of a software token during the enrollment process. It really depends on the bank.
    – John Wu
    Dec 19, 2022 at 9:24
  • 2
    Two/multi factor authentication isn't usually defined as using multiple devices or using multiple channels. Rather it means using two different types of authentication. So a system that checks for something you know (password/pin) and something you have (proving possession of a smartphone or security key) or something you are (biometrics) is considered 2 factor. But a system that just asks for a password over two separate channels isn't considered 2fa.
    – nobody
    Dec 19, 2022 at 9:39
  • 2
    Uh, okay. Didn't know governments were in the business of dictating infosec definitions :) I was just going off the definition commonly used in the security community (and the one used by our multi-factor tag). Can you link to the EU legal definition?
    – nobody
    Dec 19, 2022 at 9:46
  • 2
    @userFromEU2: "As far as I know, the two factor authentication was legally defined by some guidelines of the European Union and it does not match your description." - if you make such claim then provide the source for it. The part you might refer to is Strong customer authentication in PSD2 which is not about multiple channels but multiple elements "... that are independent, in that the breach of one does not compromise the reliability of the others".
    – Steffen Ullrich
    Dec 19, 2022 at 10:04
  • 1
    Please provide the legal definition for MFA. Since your question, and all of your comments, seems to rely on a strict understanding of what MFA is, it would be helpful if you provided the definition you are using. Else, this questions seems more like a rant than an honestly curious question.
    – schroeder ♦
    Dec 19, 2022 at 11:09

2 Answers 2

Reset to default
4

I believe that the comments have already answered your question, but I'll try to clarify what, I believe, confuses you.

Multi-factor authentication is only about how many ways you use to verify your identity. The channel through which you do it is not related to the concept, but has practical implications.

For example, opening a door of a building by inserting an access card and entering a code in the same device, is still 2FA; however, in this case, the authentication data use the same channel to reach the access decision point.

In your case, you use the bank's app to login to their systems. You enter your password (something you know) from the app that is installed in your mobile phone (something you have), which is verified that belongs to you during the app's installation/registration. It is, by definition, 2FA.

What probably bothers you is that if someone steals your mobile phone, then they could use it to login to the bank's systems by knowing the password of your account. Yes, that's true. But how is this different from the case where you try to login from your computer and you get an OTP at your mobile phone? If an attacker has your phone, they can still access your account (assuming they know your account's password, that is).

Or, yet, if you use your phone to login to the bank's systems and get an extra OTP to the same device (1), how would that be better in the case that someone steals your phone?

"Something you have" counts as a second factor in MFA, only if you actually have that something. If you lose that something then you've lost your second factor (just like losing your access card in the door example above).

(1) You could argue that you can install the app in a device, login from that one and receive an OTP to another device; unfortunately, it does not make any difference. All an attacker needs to do is to steal the phone that receives your OTP and, given that they know your password, your account will be compromised anyway

Improve this answer
8
  • You conveniently forgot that all the story of the two factor authentication was based on the idea that if someone puts a spyware on your device and finds out the password does not have full access because they would have to compromise two devices.
    – userFromEU2
    Dec 19, 2022 at 10:51
  • 3
    "two factor authentication was based on the idea that if someone puts a spyware on your device" -- no, that's not the origin of MFA. I think your entire question is based on faulty assumptions.
    – schroeder ♦
    Dec 19, 2022 at 11:12
  • @userFromEU2 what do you think, then, that the process should be? what do you propose as a solution?
    – user284677
    Dec 19, 2022 at 11:41
  • 2
    @Spyros I agree with you on all of that. I just also think that the OP's statement that 2FA is meant to protect against the case "if someone.... finds out the password" isn't a bad summary for a novice. OP has just misunderstood that a handshake tied to a crypto module in the phone can actually be far more secure than typing an OTP received via an SMS, because the attacker can't exfiltrate the CSM device key but might be able to intercept an SMS.
    – Ben Voigt
    Dec 19, 2022 at 21:27
  • 1
    That is, in case of a compromised device the attacker might be able to control the session running on the user's legitimate device. But they can't authenticate a session initiated from their own device.
    – Ben Voigt
    Dec 19, 2022 at 21:29
2

It depends. A mobile app may or may not implement 2FA. One factor can be password. Another factor can be device ID. Important is, how the device is bound to your account. Can anyone who knows your password bind other device to your account or not?

If anyone can bind another device just knowing your password, then it is still 1FA.

If binding a new device requires more than just password, it can be 2FA. For instance, the bank sends a QR code to you per normal paper mail and asks you to scan it using your device. Thus the probability is very high that the person who obtained the QR code and bound the device is you.

Or you do a video call with the bank. The bank makes sure that the person in the call is you, and you initialize the app on the particular device during this call, e.g. you tell some code generated by the app to the bank employee, or the bank employee tells you some code that you enter in the app.

Thus, the bank makes sure that the owner of the particular device is you. Together with the password these are 2 factors.

Improve this answer
6
  • This has two factors when the app is registered, not at login phase. If the device is compromised later one single action to compromise that device is enough to get access.
    – userFromEU2
    Dec 19, 2022 at 10:14
  • 1
    @userFromEU2: "the app is registered" - what do you mean by registration? The app is registered on the particular device. And the most reliable way to do that is to bind the device ID to the account. No matter what happens to the device, the ID remains unchanged, because it is embedded in the hardware.
    – mentallurg
    Dec 19, 2022 at 10:20
  • 2
    @userFromEU2: What do you mean by "single action"? If somebody gets access to your device, they don't know your password. Thus it remains secure.
    – mentallurg
    Dec 19, 2022 at 10:22
  • 2
    @userFromEU2 That is the case regardless of how authentication works. If the device is compromised, once the user has authenticated (with one, two, or however many methods), the attacker can take control of the application.
    – Gilles 'SO- stop being evil'
    Dec 19, 2022 at 11:16
  • @Gilles'SO-stopbeingevil' no - if I'm only logging in to my bank account from my computer and I'm using my phone only for receiving the second factor (SMS or via the bank's security app), one of both devices (the computer or the phone) could be compromised while the account is not. That's why I never would do online banking on the phone alone and I won't install a banking app that allows do completely access my account.
    – klues
    Apr 17 at 9:55

Not the answer you're looking for? Browse other questions tagged .