4 ms·

> It's possible to do the same banking things using the bank's website both from general purpose PCs and browsers... In my experience, this is not always the c

> It's possible to do the same banking things using the bank's website both from general purpose PCs and browsers... In my experience, this is not always the case. Some banks treat their mobile devices as more secure than website. For example, some actions would prompt an SMS MFA (I know, I know) if initiated from the website, but go right through if initiated from the app. It makes some sense, as on the app, they have access to things like location which they can use to make a better assessment on whether a request is fraudulent.

AnthonyMouse 6y ago
That's not actually letting you do something different. You can still do the thing on the website, it just requires SMS. It implies they should at most only require SMS to use the app on a jailbroken phone. Or, you know, stop doing that entirely, since SMS-based authentication is horrifyingly insecure. It's literally less secure than email, and that's a pretty low bar. People should really stop using it. Also, phones have no real way of authenticating their current location, so assuming that what the phone tells you is secure against intentional fraud is a pretty bad idea to begin with.
gengkev 6y ago
On a related note, the finance-related apps on my phone all offer me the option to sign in with a fingerprint sensor. Arguably you have two forms of authentication there: the presence of the physical device itself (using the secure element or whatever it is), as well as the biometric identifier (fingerprint scanner). Neither of those are present when logging into your bank from its website, and I would also suspect that jailbreaking a phone significantly reduces the trust you can have in either. Also, from a bank's perspective, all they care about is reducing their liability, without inconveniencing too many customers. In that context, it makes a lot of sense for banks to disallow their products from being used on jailbroken phones.

AnthonyMouse 6y ago

That's not actually letting you do something different. You can still do the thing on the website, it just requires SMS. It implies they should at most only require SMS to use the app on a jailbroken phone. Or, you know, stop doing that entirely, since SMS-based authentication is horrifyingly insecure. It's literally less secure than email, and that's a pretty low bar. People should really stop using it. Also, phones have no real way of authenticating their current location, so assuming that what the phone tells you is secure against intentional fraud is a pretty bad idea to begin with.

gengkev 6y ago

On a related note, the finance-related apps on my phone all offer me the option to sign in with a fingerprint sensor. Arguably you have two forms of authentication there: the presence of the physical device itself (using the secure element or whatever it is), as well as the biometric identifier (fingerprint scanner). Neither of those are present when logging into your bank from its website, and I would also suspect that jailbreaking a phone significantly reduces the trust you can have in either. Also, from a bank's perspective, all they care about is reducing their liability, without inconveniencing too many customers. In that context, it makes a lot of sense for banks to disallow their products from being used on jailbroken phones.