Which is more secure: banking app or browser?

Morbier

I've put this query in the Techie forum, rather than Banking, as I'm more interested in the security of the software, rather than the banking experience.

Is banking via your online browser or via a banking app more secure? Or neither?

Just wondering if any techie experts have any views/knowledge to help?

arciere

In general, if they use the same encryption, both.
However, computers (that is, browsers on computers) have more chances of being affected by viruses or other programs that interfere with internet browsing.
And also, phishing websites.

Morbier

arciere wrote: »

In general, if they use the same encryption, both.
However, computers (that is, browsers on computers) have more chances of being affected by viruses or other programs that interfere with internet browsing.
And also, phishing websites.

I use Apple OS and iOS (and anti-virus software) if that helps/makes any difference?

techquest

The biggest threat to banking security comes from using a compromised device. This applies whether you’re using a computer or a smartphone. Although phones are more easily lost or stolen, apps are in some ways safer than using a computer to log in to your bank account.

Apps, in the official app stores, are vetted by Apple and Google, whereas PCs can run software from any source. Fake apps though can turn up in app stores and malware does exist that specifically targets mobile phones. It's also more difficult to plant a keylogger (software used to track every key you press and potentially steal usernames and passwords) in an Android or iOS device.

Your Smartphone can be located, locked and even wiped of data remotely if lost or stolen (by registering for Google ‘Find My Device’ and Apple ‘Find My iPhone’), if the user has bothered to turn the facility on that is.

The use of mobile hotspots in public places, that tempt lots of users, are not the wisest of places to be banking on line.

Morbier

Thanks Techquest. Lot of useful points there. I note the point about keyloggers on mobile devices, I did wonder if it was less likely, but didn't have the knowledge to assess the risk.

No I never use my phone on a public WiFi and, yes, I have got Find my Phone activated on all my devices.

It would seem then, that neither one is worse than the other? What I mean to say is, that if you're careful about which websites you visit, don't reply to suspect emails etc etc, then you're as safe on one as the other. Whereas if you don't follow any security measures, then you can fall victim whether you're on a browser or an app.

I think that's what I wanted to hear.:)

techquest

Morbier wrote: »

Thanks Techquest. Lot of useful points there. I note the point about keyloggers on mobile devices, I did wonder if it was less likely, but didn't have the knowledge to assess the risk.

No I never use my phone on a public WiFi and, yes, I have got Find my Phone activated on all my devices.

It would seem then, that neither one is worse than the other? What I mean to say is, that if you're careful about which websites you visit, don't reply to suspect emails etc etc, then you're as safe on one as the other. Whereas if you don't follow any security measures, then you can fall victim whether you're on a browser or an app.

I think that's what I wanted to hear.:)

Yes Morbier caution is best where the net is concerned. One check is to look in the address bar of your browser, generally top left corner, secure links are https and normally you can see a green padlock at the side of the adress bar showing it is a secure link.

Hyper Text Transfer Protocol Secure (HTTPS) is the secure version of HTTP, the protocol over which data is sent between your browser and the website that you are connected to. The 'S' at the end of HTTPS stands for 'Secure'. It means all communications between your browser and the website are encrypted.

The experts in security do say that your mobile is safer than your laptop for the reasons I outlined in my first post, but not sure I agree with that.

Morbier

Thanks Techquest - you've raised a point I've often wondered about: Whenever I log into sites online, I always look for the https and the padlock. But wouldn't a fraud site also be able to show the same? That's what puzzles me.

techquest

Morbier wrote: »

Thanks Techquest - you've raised a point I've often wondered about: Whenever I log into sites online, I always look for the https and the padlock. But wouldn't a fraud site also be able to show the same? That's what puzzles me.

Sadly those “Secure” symbols don’t guarantee a website is safe from all threats. A phishing site, for example, can legitimately display that comforting green lock next to its https address.
The presence of a certificate and the green lock means only that the data transmitted between you and the site is encrypted, and that the certificate was issued by a trusted certificate authority. But it doesn't prevent an HTTPS site from being malicious, a fact that is most skillfully manipulated by phishing scammers.

Caution is always the name of the game. Know what your going on a site for and observe that what your seeing is what you expect to see. Never supply passwords and other secure information to any site. Sadly people get caught because they are not savvy when it comes to using technology on the net and that's what the scammers are praying for.

DCFC79

Going to the official banks site and not via an email link is a start.

techquest

DCFC79 wrote: »

Going to the official banks site and not via an email link is a start.

Yes forgot to mention that DCFC79

AndyPix

Using a banking app on a mobile device is orders of magnitude safer than using the website through a computer.


There are literally countless attacks I could perform on you via your pc and/or network to levvy access to your bank account if you access it through a browser ..


There are only 2 ways that i know of that could compromise you if using a banking app, and both of those are quite long drawn out processes.


Hackers go for the low hanging fruit


citation : years working in offensive security