security in banking app with 4 digit pin code and social security number

Question

The new banking app (for norwegian bank Gjensidige bank) for my android handset allows me to log in using only my social security number, and a 4 digit pin code. The social security number in norway is not a secret number (even though people usually dont post it online). The phone is registered in the internet-bank, to allow the app for each particular handset.

I dont understand how this can be a safe approach? Whatever happend to two-factor authentication?

I have even seen another bank app ( for skandiabanken, https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=https%3A%2F%2Fitunes.apple.com%2Fno%2Fapp%2Fskandiabanken-mobilbank%2Fid380663360%3Fmt%3D8 (translated from norwegian) ) on IOS allowing to log in using only a 4 digit pin code (my father asked if this was safe, but I discouraged him from installing it).

How can it be more safe to log in from a cell phone or an ipad than from a computer? There seems to be some aspect of this that I don't understand, can anyone enlighten me? (hope I'm on topic here...)

Adding some info from the comments: The phone / device had to be registered by digitally signing in the online bank. I did not need to provide any info about the phone, but the app needed to be activated with an 8 digit code after registration in the online bank.

My problem is I still cannot see the difference in principal of using an app from a phone or ipad, and using an applet (which is what is used for two-factor authentication in Norway) from a laptop.

Is two factor authentication is only necessary if the bank does not know where the request is coming from? So if I could pre-register my laptop with the bank, and in the process saving a certificate on the laptop, it would be OK to use only a 4-digit code to log in to the bank from the laptop? This sounds a lot like the login process in my I first online bank (only I needed a real password, it was not sufficient with a 4 digit pin).

Answer 1

From what you describe, the process may be the following:

• During device registration, the application on the device (be it a phone or a laptop) generates some secret value and sends it to the bank; it also stores it. This "secret" may be a secret key, or a private/public key pair: it does not matter much here. The point is that the device can now be recognized by the bank as the device.

• The "registration code" is a one-time password that you use to assert to the bank: "this is my device, remember it".

• When you log in, the device connects to the bank and uses its stored secret value to authenticate with the bank.

• The PIN code is sent to the bank for verification. The device does not store the PIN code or anything which would allow it to verify that code. The bank enforces an auto-lock policy, like smart cards do (after 3 wrong PIN codes, the bank refuses to talk any further).

• We assume that the application code is safe (unmodified by attackers); communications use SSL so that the application code is always guaranteed to talk to the genuine bank server, and data can be exchanged securely.

This indeed embodies two-factor authentication: to successfully log in, you must use the registered device ("something you have") and enter the correct PIN code ("something you know"). If an attacker steals your phone, he can initiate the connection (the bank recognizes your phone) but he will be blocked when it comes to the PIN. Conversely, if an attacker learns your PIN code but cannot grab your phone, he will not be able to submit the PIN code to the bank for verification (the bank will accept to consider a PIN code only if it comes from a duly authenticated device).

The use of the social security number is mostly for the show: it makes the process look "more secure". But it improves things only insofar as that number is not known to the attacker. As you notice, social security numbers are not really secret. They may slow down a casual, not-very-competent attacker (e.g. the guy who stole your phone and ran for it, and is trying to see whether he may "get lucky" and plunder your bank accounts as well).

Now the tricky part: how come such a scheme with a phone (or tablet) would be "more secure" than the equivalent mechanism with a computer ? And the answer is: conceptually, it is not more secure. However, there is a widespread notion that malware such as keyloggers are less prevalent in the smartphone world than on general-purpose computers. In that sense, the bank considers that your laptop is less trustworthy than your phone. This relates to the last property I listed above: the protocol works only as long as the application code is indeed unaltered and runs on hardware which is not under hostile control.