App v browser for internet banking

18cc

There has been some discussion on various threads in here over the past few months about whether it is safer from a security point of view to use an app on your phone or desktop browser combination to access your bank online

There has been some disagreement but I would like to make it clear to anybody who is interested that it is far more secure to use the app on your phone than to use the desktop environment to access your bank account

This is because the app running on the Android (and I assume it is the same for iOS) runs in its own sandboxed environment and the application code runs in its own isolated virtual machine and therefore is a complete 'Walled Garden' and cannot be accessed by external programs such as viruses, keyloggers etc

The same is not true on the desktop environment

The incidence of security problems using the desktop environment is of course low but there are still many people who have had their banking credentials harvested in one Way Or Another which has not happened on a banking app on a phone

mgdavid

18cc wrote: »

There has been some discussion on various threads in here over the past few months about whether it is safer from a security point of view to use an app on your phone or desktop browser combination to access your bank online

There has been some disagreement but I would like to make it clear to anybody who is interested that it is far more secure to use the app on your phone than to use the desktop environment to access your bank account

This is because the app running on the Android (and I assume it is the same for iOS) runs in its own sandboxed environment and the application code runs in its own isolated virtual machine and therefore is a complete 'Walled Garden' and cannot be accessed by external programs such as viruses, keyloggers etc

The same is not true on the desktop environment

The incidence of security problems using the desktop environment is of course low but there are still many people who have had their banking credentials harvested in one Way Or Another which has not happened on a banking app on a phone

Said 'some random bloke on the internet'.

EachPenny

18cc wrote: »

The same is not true on the desktop environment

What I'd like to understand is if phone apps can be made so secure by running them "in its own sandboxed environment and the application code runs in its own isolated virtual machine and therefore is a complete 'Walled Garden' and cannot be accessed by external programs such as viruses, keyloggers" then why didn't/don't the banks develop apps to run on a PC/Laptop which offer the same level of security?

With my limited IT knowledge I've often wondered why it is considered sensible to access a secure facility (like online banking) using the same application made available and designed to browse goodness knows what else on the internet. :think:

Zanderman

Agree Apps seem, logically, to be more secure. Though don't agree this means they are always secure!

Nothing is totally secure - there will always be vulnerabilities - it's just a matter of how likely they are and of spotting them before a problem arises.

On desktops vulnerabilities are more likely, or so we're told. But we take precautions, or should do. So, if adequately forewarned and prepared there isn't necessarily a high risk. The high risk is for those who aren't aware or aren't prepared.

On phones we tend to assume all's well - which may, or may not, be a sensible way of looking at it. We tend to be rather complacent - but I'm sure some hacker somewhere is looking into bank Apps!!.

EachPenny's point above re why don't banks make Apps for desktops is very valid. Why not indeed?

And the universal use of browsers for secure transactions does seem odd perhaps - but what, really, is the alternative? A different App for everything? For all secure transactions - shops etc as well as banks? The phone would be overwhelmed with Apps!!

That's why, of course, a universal browser is used - one program fits all. It may not be the most secure but is far and away the most convenient approach unless you want dozens and dozens of Apps with virtually identical functions.

I use most of the banks. I don't use many of their Apps - as if I did my phone would be wall-to-wall banking Apps. I use a desktop and browser for most - and rarely bank using the phone. Except for those that are App-only, obviously.

But why not pc-based Apps? I would like to have the option at least - as my pc has vastly more memory available than my phone and a different App for everything might be viable on the pc, as it wouldn't overwhelm it.

18cc

Yes I have also wondered why banks don't develop apps to run in the desktop environment for banking

I think there might have been banking apps for the Windows phone but you would think that they would develop banking apps for the desktop Windows environment

Maybe the fact of the matter is the desktop is too insecure even to run banking apps on it

18cc

Article in phone banking apps

https://www.mwrinfosecurity.com/our-thinking/on-the-run/

System

The biggest bank security issue is usually the customers.
Some are fairly easy to fool.

EachPenny

18cc wrote: »

Maybe the fact of the matter is the desktop is too insecure even to run banking apps on it

Actually I think the issue is broader and not dependent on the limitations of the technology. Developing anything costs money and so the main driver is responding to the largest userbase and perhaps the direction you want to steer things in relation to the corporate image you wish to project.

One large financial institution I use always develops on the iPhone first for any new initiative. I know that customers complain that android users are left behind, and the response each time is that development costs money and they can only develop on one system at a time. Fair enough, but why not develop on android first, at least for some of the new projects? The unspoken message appears to be that the FI wishes to position itself as attractive to iPhone users, for the demographic they bring with them, rather than for android users.

This same FI only supports online banking using Windows or 'Mac'. They specifically state that Linux is not supported. This is understandable in terms of the relative size of the userbase, but specifics of the wording used implies that accessing OLB using a Linux system is contrary to the T&C's with consequences greater than just not being given technical support if you need it. This is of course laughable when you contemplate the OS on which android is based.

In short, the banks are not going to develop PC-based banking apps because that market share is shrinking and they want to be "with it" using the latest cutting-edge technology. Meanwhile customers who either cannot afford to buy a new phone every year, or (importantly) struggle to adapt to new technology all the time will eventually be left in some kind of banking wilderness - with neither branches nor affordable technology being available to carry out day-to-day banking.

stehouk

I think some people are missing the obvious direction banks and businesses are heading in, the younger generations have a thirst for mobile technology, they live their lives on their mobile phones, facebook,instagram, twitter, etc etc, pay for goods, entertainment, holidays, meals, shopping, watch tv/movies listen to music, everything in one little pocket phone, this is the future why would they invest in dated technology such as laptop/desktop pc's.
Banks save a fortune if a computer handles their customers accounts that is why branches are closing every where.

Zanderman

stehouk wrote: »

I think some people are missing the obvious direction banks and businesses are heading in, the younger generations have a thirst for mobile technology, they live their lives on their mobile phones, facebook,instagram, twitter, etc etc, pay for goods, entertainment, holidays, meals, shopping, watch tv/movies listen to music, everything in one little pocket phone, this is the future why would they invest in dated technology such as laptop/desktop pc's.
Banks save a fortune if a computer handles their customers accounts that is why branches are closing every where.

The argument that banks save a fortune if a computer handles the account instead of a branch applies equally well to pc browsers as it does to Apps, more so in one sense as the browser system is ready-made and the app has to be built. So that's not an argument for apps. It's just an explanation for any online banking.

I would agree though that the trend is towards Apps in the younger generation - but would question where this will all end. Multiple apps basically doing the same thing for banks, shops etc? Clogging up phones? The logical next step would be, wait for it.... an aggregated system that deals with all. It could be called, a browser!

I jest. But only to some extent. Aggregate financial apps are out there already, so gluing loads of them together is certainly feasible. But once one system becomes dominant (as it probably would, eventually) that would be the target for scammers. And then we could start over....