And yet, many financial institutions aren’t striving whatsoever. They’ve accepted a status quo that sacrifices user experience for increased security—even when that security is itself unreliable (we’ll get to this below). This is a huge missed opportunity. Mobile digital identity is quickly becoming central to an entire suite of online services, including not just banking but enterprise and government functions. Institutions willing to challenge the status quo and work toward creating frictionless, secure mobile solutions will set themselves up to prosper and grow—while those that don’t doom themselves to fall behind.
But if companies want to challenge the status quo, where should they start? Below, we describe three oft-ignored areas of research that could yield revolutionary innovations in mobile fraud prevention—and make today’s friction-filled user experiences a thing of the past.
1. Build a software security token that works
Many banking institutions have accepted the inconvenience of hardware-based security solutions as the non-negotiable price of preventing hacking attacks. However, these solutions aren’t as foolproof as their complicated structure makes them seem. As the famous 2011 hack of RSA tokens goes to show (or the more recent case in Singapore where 50 smartphones were hit by malware targeting mobile banking customers), hardware dongles don’t guard against one of the simplest of all hacker tactics: phishing. Because the dongle is totally isolated from the software, the user can be tricked into providing a OTP for an action different from the one that they think they are engaging in. In the case of a financial transaction, the attacker is then able to alter the payee, the account number, or other information in order to divert funds away from the victim’s account and to another source.
A software security token that displayed the OTP on the device screen next to the prompt for the associated action to be taken, or that sent it directly to the mobile banking server from the user’s device, would solve this problem by connecting the generated code and the action. It would also eliminate the need for a friction-inducing hardware dongle. However, even today’s state-of-the-art software security tokens are relatively easy to crack—a committed attacker can gain access to one within 2-3 days, provided they have physical possession of the device.
That’s not to say, though, that a more secure software solution is an impossible dream. With all the focus on hardware security over the past decades, innovation on the software side has been neglected. By investing into a new platform that replicates hardware security in software, a forward-thinking company could come up with a new solution—one that would make phishing attacks a thing of the past.
2. Design an OS that apps can trust
Every smartphone on the market today has a secure hardware element or elements. The iPhone has a secure enclave where the Touch ID fingerprint is processed, for instance, and encryption for GSM calls is processed through a secure element on the phone’s SIM card. However, mobile applications can’t access any of these secure hardware elements directly. Instead, they have to trust the phone’s underlying OS when it tells them that a user has been authenticated.
This is very problematic for application providers. Any app will be rolled out to millions of mobile devices, at least some of which will be jailbroken, rooted, or infected with malware. In these cases, the assumption that the application can trust the front line operating system doesn’t actually hold. The current solution of providing hardware dongles is a workaround for this issue—but as noted above, it’s not a foolproof one. If a company could design a secure element that apps could safely access—verifying identity directly instead of trusting the OS—it would eliminate the need for such workarounds, and open up the possibility of near-frictionless logins for secure apps.
3. Process private information in the device itself
From banks to governments, more and more institutions today are looking at biometrics like fingerprints, retinal scans, and facial recognition to identify end users. This approach has many friction-reducing advantages: it eliminates the need for the user to type in (or memorize) a password or to carry around a dongle in order to prove their identity. However, it also raises serious privacy concerns. Under the current system, biometric information collected by a device usually must be cross-referenced with existing records, i.e. a driver’s license database, on an outside server. This creates multiple vulnerabilities to a hacking attack, as well as compliance concerns for companies storing such sensitive information on their backend.
However, all is not lost. If the authentication process happened entirely inside the device—in a secure element that apps could access directly, without having to trust an OS, for instance—the privacy issue with biometrics could be avoided entirely. Logins to mobile apps could finally be both frictionless and secure: users would just have to press down their fingerprint or snap a selfie.
There you have it: a roadmap to creating an app as frictionless as Facebook, but more secure than today’s most hacker-proof online banking platform. For too long, mobile security has focused myopically on hardware; it’s time for mobile app providers to reverse that bias and begin exploring potentially transformative software innovations. Their users’ privacy and security—and their own companies’ bottom lines—depend on it.
With contribution from the Hippo Thinks research network.
