News Archive 2007

13.11.2007
SMS one-time passwords are vulnerable
Finextra reports on unacceptable human error rates when just relying on passwords sent via SMS.

The study conducted by Queensland University of Technology (QUT) in Australia reports that manual entering of one-time passwords from a short message to an online bank login website still carries a high risk factor.

Valimo's mobile signature solution adresses the concerns raised against the OTP method.

When using Valimo's mobile signature solution:

Consumers receive authentication and signing requests to the mobile phone via Valimo Validator - MSSP. The product uses public key cryptography and an authorization process that allows only bona-fide online banking systems to reach the user's mobile phone
Consumers do not need to manually copy text out of the received short message. They confirm the login or transaction by returing a digitally signed message via SMS to Valimo Validator - MSSP
The communications between VMAC (i.e. the signing application on the phone's SIM card) and the online banking system is encrypted.
For each authentication or transaction signing event sent to the consumer there is an electronic record (i.e. digital signature) that can be verified by a third-party process.

The basis for verifiying and validating an authentication or signing event is:

The user's digital certificate
The text that was sent to the phone
The digital signature, generated by having the user enter a Signing PIN.
The authenticated online bank system that communicated with Valimo Validator - MSSP

Still unsure about the value- and security-added of mobile signatures and Valimo's offering? Contact Valimo and we walk you through each feature.

The Finextra news item concludes:

"However in the UK ost banks are avoiding SMS systems in favour of a programme, backed by payments association Apacs, to roll out handheld chip and PIN devices to Internet banking customers."

For Valimo's mobile signature offering there is no need to distribute chip and PIN devices. Consumers use their GSM phone and a mobile signature-enabled SIM card to achieve the same level of security with a clear advantage on ease of use and user convenience.

Source: