Improve user account security

Hi,

I think MD should really have two factor authentication for user login. If login details are compromised then the following would be available:

  • GDPR Sensitive Personal data could be derived from financial transactions
  • User’s bank account details are visible from the account list page
  • It’s possible to create financial transactions (move money) using MD

Can you implement industry standard 2FA process (App based 2FA using QR code), preferably with support for security keys?

Thanks
David

2 Likes

Agreed. This is very important as an AISP (and potentially PISP)

Also, the recommendation to share login details with your spouse (when dealing with a household budget) is not security best practice

2 Likes

Very important and could be a reason to leave

Am i missing something ? … The app has 2FA when logging on (if you enable it, so maybe it should be required) There is 2FA for connecting to accounts (where supported by the banking app).

I see 2FA setup on the community app, but not on the main app.

Thanks all. These suggestions have been noted.

If we decide to prioritise it would need to be an option as it’s likely the majority of users would find this overly cumbersome. Interestedly I’m not seeing this as an option on my banking app where transactions can be initiated? Let me know if I’m wrong.

If a third party did gain a users password they would have access to sensitive information. For them to move money between accounts they would also need to have the account access details of the banking app where the money is transferred from. Essentially there is an additional layer of security.

Apologies for the long post @iainnib

I agree that 2FA should not be mandatory.

I believe most UK high street banks are required to provide some form of MFA at login as of March 2020. This challenge will usually be via a OTP generated by an app, or an automated call, or a text message (or parts of a shared secret).

Some banks allow the user to be remembered on the device so that they don’t have to provide 2FA at every login (e.g. may only need to provide a username / password).

I suggest for MD that:

  • 2FA is optionally enabled for logins using an authenticator app
  • The sort code and account number in the Account list partially or entirely obfuscated so that there is no way to get this even after login (e.g. if the user opts not to have 2FA)