0

I am wondering - is using Google Accounts login (in a setup similar to this) secure enough for financial services (you can assume that if someone logs into your account, your money gets stolen)?

On one hand, if you tell the users to create a new Google Account for the service, add 2FA and so on, you would be relying on a company with a lot of experience to prevent unauthorized login attempts. At the same time, some people will use their main Google account to log into everything and their accounts will probably get compromised, and rolling out your own solution means you have to play catch-up with years of security expertise and new vulnerabilities.

What is the consensus on how secure Google Accounts login is in this scenario?

1

No.

I'm not even talking about whether it's good enough for finance or not, I'm just saying if Google is the only way to login to your service, then I won't use it, and neither will do other privacy-conscious users.

Now, on the technical side. Using third-party logins is less secure because a failure on the third-party site will also affect yours, and the third-party site can itself impersonate any of your users. With your own login, you only have to defend your infrastructure. With third-party logins, you have to defend your infra and hope the third-party's infra is secure.

On a legal side, having your own login system means you have better control and auditing over who did what and when, where as with Google (or any third-party service) all you have is "someone pretending to be X logged in at that time from this IP". Whether they did password recovery beforehand, or had 2FA enabled is something you don't know and can't enforce. When something goes awry, you won't be able to prove it's the user's fault of not securing his account well enough and will have to pay, where as with your own system you'll be able to say "at X in the morning someone reset your password and you didn't have 2FA enabled. Sorry, it's not our fault, now you better work on securing that email account".

Finally, secure logins aren't that hard. Correctly hashing passwords, not doing stupid mistakes like sending the password in emails, using captchas to thwart bruteforce, locking out IPs after multiple failed logins and providing 2FA using standard protocols is all you need to be secure. In comparison, this is what my bank's login process looks like :

security disaster

Yes. My bank is one of France's largest banks, and their login consists of an 8-digit user ID followed by a 6 digit (no letters, that would be too much to ask) secret code, that you have to enter in a cute little security theater because according to their "experts" someone capable of keylogging isn't capable of taking screenshots of where you click. There is obviously no 2FA, and I wouldn't be surprised if the secret code was stored in plain text. The only good thing is that they lock out IPs after 5 login attempts, but that's about it.

So assuming you do everything I told you above, you'll be more secure than one of the largest banks here; as a little extra precaution you may use a random user ID instead of something known like an username or email (but that makes the user remember two things instead of only the password, which in turn may make them choose a weaker/easier to remember password or to reuse one they already have).

Of course, security of logins isn't the only thing you need to do especially on a finance website. You should also make sure your own servers are secure, so you need to have IDS, monitor every service, check logs often and prepare to act quickly if something appears fishy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.