Members Opinions
Strong authentication, as we know, must be implemented as a compromise between security and user convenience. This holds for any kind of service, but this is particularly true for mobile, consumer-facing services, because both the mobile device and the large, not tech-savvy audience, introduce specific UX (user experience) requirements. Mobile banking should therefore see ideal implementations of strong authentication. But apparently, something went wrong…
Living with the legacy of e-banking authentication
Banks have generalized the use of mobile phones for authentication around 2007-10, usually as a consequence of regulations about online payment security that required a dynamic authentication. As most retail customers had at least a basic phone, "SMS-OTP" - random codes sent in a short-text message used to confirm a transaction - were seen by most banks as a convenient, secure, and inexpensive way of becoming compliant (SMS-OTP fell short of meeting all 3 expectations, of course, but that's another story - or post...).
"Soft-tokens" - mobile Apps generating one-time authentication codes - were also rolled out here and there, but never generalized, probably for bad timing reasons: by the time compatible phones were widely available, App banking had already taken off, so banks would never be able to explain to their customers why 2 Apps were required.
Nevertheless, in a way or another, mobile phone has become a widely successful out-of-band second factor in e-banking. Then came m-banking...
Initially m-banking operations were very restricted, because there was no good way to secure sensitive operations: it's really painful to enroll users in a strong authentication solution, such a solution was already in place, and it had been "designed" (!) for e-banking only. Ironically, banks that had deployed old-style key-chain tokens had a slight advantage in securing m-banking. Those having deployed CAP (Chip Authentication Program) were completely left behind - don't laugh, some banks still signed up for CAP as late as 2011! (by which you may have guessed that I was living in France at that time...)
M-banking authentication era
Like it or not, authentication for m-banking era can't be out-of-band. Using key-chain tokens to keep a smell of a separate device doesn't make any sense as it doesn't protect from phishing or malwares, so there are really no valid out-of-band options.
in-App authentication has been proposed as the m-banking authentication mechanism. For example, inWebo proposed a SMS-free in-App authentication concept as early as 2010, and released a security-certified product as an SDK in 2012.
in-App authentication makes m-banking security really convenient, as 2FA can be completely hidden to users - the same way in-browser 2FA does it for web sites. But that's the theory. In practical terms, banks still struggle to make 2FA - and security in general - a seamless experience.
Just one example with ... a well-known global bank. I see no need to expose this bank to public irony - first because I'm not sure this post would reach executive ears and ultimately make customers' life easier; second because one would get the impression by contrast that other banks are performing much better: actually, there's no winner! Let's mention that it's not a 2010 example as you would think, but the brand new, just released, 2013 in-App 2FA enrollment process! So here's what you have to do, take a deep breath:
- sign in to your online account from a web browser
- create a secrete question and answer - you know, something like "what is the last book you have read?" (you're not required to rate that book though)
- download the mobile App
- enter your credentials and the answer to the secrete question
- define a password in your online account
- enter it in the mobile App
- obtain a first activation code from your online account
- enter it in the mobile App
- receive a second activation code by SMS, email or post (yes, post!)
- enter it in the mobile App
- define your PIN in the mobile App
- you're all set!!!
Half-way reading this list, most of you have probably checked if, by any chance, this post hadn't been written on April 1st. But unfortunately, it's not a joke!
However, the exact reason why it's so f... weird and complex is an open question I address to the audience. I have a few tentative explanations in mind: a) the process was reviewed at all hierarchical levels, each one adding a step, b) they stopped adding steps when they couldn't figure out additional ones, c) some pre-Millenial consultant suggested that the more steps, the more secure customers would feel.
That last one is probably true. If there are any customer left...
Written by Didier Perrot
Here are the links to the presentations from our speakers.
Thanks to all of them for coming speak at this event that early in the morning.
Thanks also to City National Bank for making this event possible in sponsoring it.
Contact us at This email address is being protected from spambots. You need JavaScript enabled to view it. if you want to sponsor a BayPay event.
This deck was presented by William Hsu (see bio below), Co-Founder & Managing Partner at Muckerlab during the BayPay Forum event focused on Entertainment on October 25, 2013 hosted by City National Bank.
Remember you can add comments, questions or remarks below.
William Hsu, Co-Founder & Managing Partner at Muckerlab
William has spent his career as both a startup entrepreneur as well as an executive of a Fortune 100 company.
Prior to MuckerLab, William was the SVP and Chief Product Officer of AT&T Interactive where he owned P/L, Product Management, Product Marketing, and UX responsibilities for all digital advertising initiatives for greater AT&T. In 3 years at AT&T Interactive, he doubled revenue to over $1B and helped established AT&T Interactive as the 9th largest digital media company (ahead of Facebook), the largest digital local advertising company (ahead of Groupon), and the 2nd largest mobile advertising company (behind Google) in the U.S.
Almost 13 years ago, as a 23-year old, he was the founder and EVP of Product Development for BuildPoint – the leader in providing bidding management & marketplace services to the commercial construction industry. William helped the company grow to over 250 employees and raised over $50M in venture capital. The company was acquired in 2004.
In between, William has led product teams at eBay, Green Dot (GDOT), and Spot Runner.
William has a B.S. in Industrial Engineering from the Terman School of Engineering at Stanford University and a MBA from the Wharton School of University of Pennsylvania.
William can be reached at william at muckerlab dot com.
This deck was presented by John Trefry (see bio below), CEO at 4WT Media during the BayPay Forum event focused on Entertainment on October 25, 2013 hosted by City National Bank.
Remember you can add comments, questions or remarks below.
John Calkins, IBM Partner and Vice President Strategy and Transformation Center of Competence at IBM
John Calkins leads the Digital Front Office initiative within the Strategy and Transformation Center of Competence for IBM. In this global role, he leads a team focused on helping clients across multiple industries develop strategies to address the challenges and opportunities raised as consumers and businesses increasingly interact in a multi-channel, interactive environment, with expectations for personalized marketing and highly intuitive, consistently world class usage of data to support the customer experience wherever it occurs.
Prior to joining IBM, he was Executive Vice President, Global Digital and Commercial Innovation for Sony Pictures Home Entertainment, responsible for the digital transactional exploitation of SPE's film and television properties around the world, as well as developing and helping to implement an integrated approach to the home entertainment market across both digital and physical channels of distribution.
Previously at Sony he served as Executive Vice President of Corporate Development for Sony Pictures Entertainment (SPE), responsible for driving corporate initiatives in emerging business areas, coordinating corporate and divisional investments and divestitures and overseeing the implementation of the SPE mid range planning process. Prior to coming to Sony Pictures, he was President of Warren N. Lieberfarb & Associates (WNLA), charged with day to day responsibility for the company’s operations in its consulting practice and in its exploration and pursuit of opportunities in broadband video distribution, with backing from Microsoft, Intel and others. He came to WNLA from Warner Bros, where he ultimately held the post of Senior Vice President of Corporate Business Development and Strategy. In this role, Mr. Calkins became intimately involved in the Studio’s entry into such technology-driven aspects of the entertainment industry as wireless distribution, multi-player video gaming, and Video-on-Demand. He was instrumental in the creation of Movielink, the five-studio joint venture to distribute theatrically-released motion pictures on the Internet. He joined Warner Bros. as its Vice President of New Media Business Development in 2000.
Prior to joining Warner Bros, Calkins was with McKinsey & Company, as an Associate Principal in its Los Angeles office. During his four years at McKinsey, he developed strategic recommendations for companies in such diverse industries as theme parks, the Internet and retailing. He has also held positions with Trammell Crow Company and Pepsico’s Taco Bell restaurant division, and received his MBA from Duke University’s Fuqua School of Business as a Fuqua Scholar, awarded to the top 5% of the class. He has also been active on a number of private company and charity boards of directors.
This deck was presented by Ethan Applen (see bio below), Executive Director at Warner Bros. during the BayPay Forum event focused on Entertainment on October 25, 2013 hosted by City National Bank.
Remember you can add comments, questions or remarks below.
Ethan Applen, Executive Director at Warner Bros.
Ethan Applen is focused on the intersection of technology and entertainment, predominantly in how emerging technologies will radically change how consumers experience media entertainment content.
He has done extensive work in the area of innovation and facilitation as a catalyst for growth; this includes internal innovation initiatives targeting new processes to enable quicker ideation, prototyping, and launching of ideas to market, as well as external partnerships allowing for innovation through collaboration (through partnerships, JVs, commercial deals, and direct investments/accelerator models).
Ethan has a history of success in building and launching new models and products to the market. Home brewer.
Home chef. Gardener. Carpenter. Fledgling guitar player.
Specialties: Strategy, Organizational Innovation, Emerging Technology, Business Development, Relationship Building, Negotiations, Strategic Valuation, New Media
- Filmtrack Presentation from BayPay event on Entertainment, October 25, 2013 in Los Angeles
- 4WT Media Presentation from BayPay event on Entertainment, October 25, 2013 in Los Angeles
- Simplifying online identity verification through patented technology of miiCard
- Ripple solving p2p by reducing the speed and cost to send money globally in seconds at minimum fee