Comment by jcsager
5 days ago
Web banking means you need the card reader gadget as well for the authentication. The app uses secure features of the OS to aid authentication so you don't need to read the card. Web access on your phone still needs the card reader gadget.
Depends on where in the world you are, Norway for instance has not been using card chips for 2fa consumer auth for banking. Instead the 2fa has been a separate code generating gadget, and now also alternatively an app (which I do get the feeling the company that the banks set up handle auth for all of them are kinda pushing everyone into, but for now there thankfully is an option where you only need 1 online device with nothing more than a functioning browser).
Modern cards and phones support NFC, so you would only need a "gadget" (NFC reader) when using a PC that doesn't already have one, and a USB one is ~$20.
What this really needs is better browser support for NFC:
https://developer.mozilla.org/en-US/docs/Web/API/Web_NFC_API
But so let's do that then.
That isn't the kind NFC you think it is.
It's RFID communication with a smart card. The bank would have to transmit keys to your computer to be able to interface with it, which they probably won't want to do for security reasons.
The way chip cards work is that a challenge is issued to the card and it sends back a response. The challenge is just a random number that makes it so you can't replay a previous response to a future challenge. The bank can then verify that the response came from the card, i.e. that you have the card right now.
Your computer doesn't need to have any keys to do this. The card has a secret key, but it doesn't give it to the reader, it just responds to the challenge. The challenge often comes from a point of sale terminal, but it could just as easily come from the bank's web servers, and it isn't really a secret.
The only thing which resembles a secret here is the response from the card, which is the thing anyone can get regardless when have the card. Also, the entire premise of the card is that the attacker doesn't have it, so if they do then you've already lost that part of the game.
It's not the NFC the bank is interested it, it the MFA provided by your phone PIN, fingerprint or face unlock.
When you open the app on your phone, the phone probably needed to be unlocked first, though not everyone sets a PIN or biometric lock on their phone.
Then you will be prompted for a separate PIN or your fingerprint within the banking app. This provides a stronger signal to the bank that you are the legitimate account holder. If your phone is lost or stolen, the chances of someone else being able to authenticate to your banking app are considerably reduced.
With the web app, people will often save their bank website login credentials in the browser. So now someone nefarious only needs to access the unlocked computer or phone the go to the bank's website to gain unauthorised by still authenticated access to the customer's accounts.
Yes, there are now laptops and tablets with biometric authentication, so the potential is there for adding biometric authentication for banking website. However, when you look at the demographics of banking app vs website use, a strong majority of Millennials and Gen-Z do all their banking via the phone app. Gen-X also slightly favour the phone app whereas Boomers strongly prefer the website. So banks focus their development efforts where the majority of users are.
> When you open the app on your phone, the phone probably needed to be unlocked first, though not everyone sets a PIN or biometric lock on their phone.
The same is true for PCs. They've supported that sort of thing for decades, and it's optional for both the phone and the PC.
On top of that, a phone that people carry around everywhere is dramatically more likely to be lost or stolen than a desktop PC that never leaves their house.
> With the web app, people will often save their bank website login credentials in the browser.
If the bank actually cares about this then there are various ways to disable or impede it.
> However, when you look at the demographics of banking app vs website use
This is just the thing where you make something worse so fewer people use it and then use that as an excuse to keep making it worse. Nobody needs an app that could have been a web page, people use them because it's what get shoved down their throat if they don't go out of their way to do something else.