The new banking app (for norwegian bank Gjensidige bank) for my android handset allows me to log in using only my social security number, and a 4 digit pin code. The social security number in norway is not a secret number (even though people usually dont post it online). The phone is registered in the internet-bank, to allow the app for each particular handset.
I dont understand how this can be a safe approach? Whatever happend to two-factor authentication?
I have even seen another bank app ( for skandiabanken, https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=https%3A%2F%2Fitunes.apple.com%2Fno%2Fapp%2Fskandiabanken-mobilbank%2Fid380663360%3Fmt%3D8 (translated from norwegian) ) on IOS allowing to log in using only a 4 digit pin code (my father asked if this was safe, but I discouraged him from installing it).
How can it be more safe to log in from a cell phone or an ipad than from a computer? There seems to be some aspect of this that I don't understand, can anyone enlighten me? (hope I'm on topic here...)
Adding some info from the comments: The phone / device had to be registered by digitally signing in the online bank. I did not need to provide any info about the phone, but the app needed to be activated with an 8 digit code after registration in the online bank.
My problem is I still cannot see the difference in principal of using an app from a phone or ipad, and using an applet (which is what is used for two-factor authentication in Norway) from a laptop.
Is two factor authentication is only necessary if the bank does not know where the request is coming from? So if I could pre-register my laptop with the bank, and in the process saving a certificate on the laptop, it would be OK to use only a 4-digit code to log in to the bank from the laptop? This sounds a lot like the login process in my I first online bank (only I needed a real password, it was not sufficient with a 4 digit pin).