How safe is Money Toolkit?

Question

Money Toolkit is a smartphone app that can alert you to your balances and transactions across multiple accounts.

I was reading their site and whether their practises are as secure as they claim to be.

From their page at http://www.moneytoolkit.com/2010/09/secure-mobile-banking/, these paragraphs are of interest:

Only you and your bank can get at your bank security answers, they are securely encrypted on your phone. In fact once you have entered them on your phone, not even you can see them, they are stored in Money toolkits 128 bit AES encrypted safe, using your password as a key, and your password is stored in a way that is almost impossible* to be decoded (using SHA-256).

But then comes the really clever bit. We actually dont store the whole encrypted file on your phone. We split the file into three parts, only one is stored on your phone, the other two parts are sent to two different servers somewhere in the UK. Each part is totally useless without the other two parts. So if anyone finds or steals your phone – it is literally impossible for them to recover your secure details. Similarly if anyone manages to breach our military grade security on our servers they will still be completely unable to recover your secure details, unless they also have your phone.

The advantage of this system is that It makes it literally impossible for anyone who has physical access to your phone (through theft, or otherwise) to recover any of your secure data from the phone. Not only would someone have to get access to your phone they would have to go to the same lengths as they would if they wanted to ‘hack’ into a bank, but they would have to do it three times!

On their page at http://www.moneytoolkit.com/2012/02/military-grade-security/

1. We use SSL for all our communication over HTTP – between our apps and servers and between servers. Our trafic can not be eavesdropped.
2. All other administration communication is done via SSH.
3. Passwords are never stored – we always use SHA hashed passwords with heavy and dynamic salting.
4. All other data is encrypted on our servers, using AES.
5. The data centers we use are accredited to ISAE 3402
6. A lot of our service runs on Google App Engine who have an exemplary security record… 24 hour guarded data centers, airlock entry, NO security breach ever and more… more info.
7. We are a small company, and every employee or contractor is well known, and follows the best security practices. No customer data is ever allowed on individual storage devices, so can never leave the data center.
8. All of our systems and servers are regularly patched and hardened, no personal data is ever stored in any logs.
9. Our development and deployment process is strictly controlled with a continuous integration server running a battery of tests, not just for reliability, but for security as well.

Also this page includes all the technical detail of their method:

http://support.moneytoolkit.com/customer/portal/articles/83086-how-it-works-in-very-technical-detail

Are their any flaws in this design? Any potential weaknesses? Could they be trusted with my bank details?

Answer 1

The method looks like a transport key approach to securing the data using three independent parts which are each secured by something that the user knows. The combination of each of the component keys provides the unlock/lock functionality.

• One of the weaknesses of this model is that if you loose one of the components then you will not get your data back - but in this case there does not seem to be any data persisted that can't be re-produced by re-setting up the accounts and so on.
• A strength and weakness of this model is that the more components you have of the key, the better the security at the cost of usability. i.e. there is a greater chance of loosing one of the keys if one of the sources is unavailable. So, you could be more easily locked out of your accounts if one of the independent data centres is having a bad day - or an attacker is denying you access by blocking your access to one of the keys. Again, given it is just account information - it's not the end of the world if you have to wait a short time but every situation will have different tolerances. (please don't use this method on a life support machine for example).
• Another strength and a weakness is the fact that a lot of this is relying on infrastructure outside of your control. i.e. you don't even have a contractual relationship with the 3rd parties. For this applicataion, this is probably OK - but not if you are a company using this app. Again, it depends on your own personal risk appetite (personally, I wouldn't touch it with a bargepole)
• The notes are a bit rubbish. Yes, they use SSH for admin - but it is easy to use SSH in a really poor way. I have a few alarm bells ringing because they've even chosen to say this publically. It indicates that they think this is the second most important thing to say which is quite worrying.

Are you in breach with your bank?

Perhaps most importantly, are you in breach of your terms and conditions with your bank by using this application? Indeed, if you are a UK customer (which i am guessing you are) then you most certainly will be so if this does all go wrong then you will be help personally liable. If you have insurance against identity fraud etc, then it is unlikely to pay out if you have willingly used a service like this...

Answer 2

Firstly it is refreshing to see people discussing security at this level of detail.

Callum Wilson completely nails it in terms of security vs usability. The app does have some problems with usability, we cant offer a password reset, and we can never recover any data if a key is lost.

It turns out this is a big weakness in the viability of the app; most people only think they care about security. Those that actually do care, and do understand, tend not to trust this kind of app in any case. Even if the security approach and system appear robust, there are just too many risks in the minds of the enlightened: are they actually doing what they say they are, what if a developer makes a mistake, have they fully audited the logs for leaks, and as you say, are the third party providers doing what they contracted to do.

Having said that, as the founder and lead developer of the app I am confident that the systems are robust. As in most secure systems the weakest link are the humans involved, so we never really captured the hearts of a security aware audience, or of the general consumer.

Regarding the notes on 'military grade security' - We tried to strike a balance between accessible information and technical detail. Using phrases like 'military grade' tends to raise the hackles of the security community (and mine). It is used summarise a complex set of systems and behaviours briefly enough to capture the attention of the larger customer base.

Regarding the relationship with banks, we attempt to address the current situation in the uk here http://support.moneytoolkit.com/customer/portal/articles/83114

The biggest reason not to use Money Toolkit at the moment is that we are in a lull, and the future of the app is unclear.