4 ms·
Recently in Germany many banks introduced a new "security" feature that allows you to receive your TANs per SMS in order to do online transactions. The TANs are
by caxap 15y ago
Recently in Germany many banks introduced a new "security" feature that allows you to receive your TANs per SMS in order to do online transactions. The TANs are sent in plain text.
All you need is a UMTS receiver and a way to analyze the data, e.g., a software-defined radio implemented on an FPGA.
- Maxious 15y agoIsn't this more secure than having nothing? There is a large additional cost to the wrongdoers in that they have to get close to you (even if they know your home address, how do they know you and your phone are home). Seems like a deterrent when you could be running credit card phishing sites for less work per victim. And you would still get the intercepted text, the ones I get from my bank in Australia suggest if you didn't request the token to contact them immediately.
- aristidb 15y agoThe old alternative in Germany was that you had a piece of paper with numbers on them. So it absolutely may be a step backward.
- stesch 15y agoI might add, that the numbers were indexed and the banking software was requesting a random TAN. This was called iTAN.
- darklajid 15y agoWe had both (both the original TAN list where every number could be used just once and invalidated all previous numbers on the list and the iTan system). I prefer the token thingy my bank gave me. Insert your direct debit card, enter two numbers from the screen (usually corresponding to your transaction in some way, to confirm _again_ that you're really trying to send money to account X) and generate the TAN. Done.
- coffeeaddicted 15y agoMy bank (Landesbank BW) gives you hardware (looking a little like a calculator) where you for example type in the bank-number of a person to whom you send money and then it'll calculate some PIN for that action.