41–50 of 67 posts
Fresh in my mind is the Wii U controller reverse-engineering presented at 30C3, where the WPA-PSK handshake protocol was tweaked by performing bit-rotations on the resulting keys.
Earlier quoted context omitted.
This specific token is time-based, so a clone would not be detected. On the other hand, counter-based tokens as you described them do exist, and it would indeed be simple to detect if one of those was cloned. I wouldn't even call this an attack, given that you would need physical access to a rooted device to carry it out.
Ah, time-based tokens are basically against adversaries with physical access to your time-based token. Good against password guessers / leaked password databases, however, which is a much more realistic attack these days.
Think about it for a moment. He did all this (impressive) work just because the application that the bank provided sucked. Now, once he writes a better app, what do you think the bank will do? Hire him (or buy the app), or fight him? How much effort do we collectively waste because of moronic organizations that force their crap upon us, that we cannot escape from? (You can go to a different bank, but what if they all…
I find it so frustrating that many organisations put massive efforts into software that is very locked down and not as good as the community would provide for themselves and probably share for free. This is particularly obvious in the case of media companies and banks. If they provided a nice API instead of specialised webapps, there'd be beautiful and more functional applications available for free to their customer…
While I don't know about the situation elsewhere in the world, here in Germany most banks retired the single use codes (called TANS or (if indexed) iTans) quite some years ago for being insecure. Most online banking will now require a code created per transaction that is 1. either send to you via text on your mobile phone (and is thus prone to phone malware) or 2. is generated using an external device and the chip on…
Which security concerns have been voiced against iTANs? I saw them as the equivalent of a one-time-pad, secure as long as both the secret and the index are not both intercepted. And super cheap and simple.
Think about it for a moment. He did all this (impressive) work just because the application that the bank provided sucked. Now, once he writes a better app, what do you think the bank will do? Hire him (or buy the app), or fight him? How much effort do we collectively waste because of moronic organizations that force their crap upon us, that we cannot escape from? (You can go to a different bank, but what if they all…
I don't really agree with the description of the app: "the application that the bank provided sucked". What's the reason for this? The only thing he didn't like about the app was that when he reflashed the phone he had to re-register it. ("calling the bank every so often after changing ROMs, resetting or changing phones") Does that app suck? I don't think so, you should reauthorize the app on every new device and if…
Earlier quoted context omitted.
For my bank (Nordea in Finland), it's numeric user id + single-use 4-digit code (on a physical card; they automatically mail you a new one when you're starting to run low on codes) to log in to net banking. A random one of ~30 multi-use verification 4-digit codes is then used to confirm a transaction. In addition, the Nordea mobile app uses a request to activate a single 4..8-digit password for read only access to yo…
Nordea's finnish service was the simplest, most comfortable service of all the (4) european banks I've tried. And I liked that their service is not fancy for fanciness' sake. (In terms of the way the website looked and functioned) Not anymore a customer, unfortunately.
That said though, I'm so happy Nordea finally added free TSV export of bank statement data. I rolled my own analytics script in Python based on that... :)
Earlier quoted context omitted.
I don't really agree with the description of the app: "the application that the bank provided sucked". What's the reason for this? The only thing he didn't like about the app was that when he reflashed the phone he had to re-register it. ("calling the bank every so often after changing ROMs, resetting or changing phones") Does that app suck? I don't think so, you should reauthorize the app on every new device and if…
He was able to reverse engineer the whole process. The bank's app definitely sucks.
While I don't know about the situation elsewhere in the world, here in Germany most banks retired the single use codes (called TANS or (if indexed) iTans) quite some years ago for being insecure. Most online banking will now require a code created per transaction that is 1. either send to you via text on your mobile phone (and is thus prone to phone malware) or 2. is generated using an external device and the chip on…
Makes me want to ask: you really want to charge me for an SMS after all the interest you make from me leaving my money there?
But I suppose TANs are still preferred by the luddites that abound in Germany
I suppose my bank token uses the same structure and produces a similar code (but I haven't reversed engineered it though)
While I don't know about the situation elsewhere in the world, here in Germany most banks retired the single use codes (called TANS or (if indexed) iTans) quite some years ago for being insecure. Most online banking will now require a code created per transaction that is 1. either send to you via text on your mobile phone (and is thus prone to phone malware) or 2. is generated using an external device and the chip on…
To make an online transaction with it you insert your debit card into it, enter a random sequence of digits displayed on the bank website as well as your PIN in the dongle to get a sequence of digits that you enter into the dongle again.
I found it annoying to have to carry this device everywhere in case I needed to make a bank transaction, so I went with the only bank in The Netherlands that does TAN codes, ING.
Every 6-8 months or so I'll get a sheet of 100 TAN codes in the snail mail, I'll OCR the full sheet with offline-enabled Android app whose name I forget, convert it to a text file, edit it a bit, and encrypt the text file with GPG.
Then when I need to make transfers I can ssh to a box or use my laptop to "gpg -d tan.txt.gpg | grep ^123" where 123 is the TAN code number that the online form requests.
They recently amended this system so that there's a second set of TAN codes (that comes in another snail mail) that they'll supposedly ask for if you make a transaction from a suspicious IP address, I've yet to use one of those.
It sucks a bit but I find it far better than having to carry some device on my person at all times.
