On Android I found an app which sets protection to any app :
Monzo on iPad doesn’t really have much benefit over Monzo on iPhone from what I see. It’s just another scaled up iPhone app.
Call me paranoid but I prefer my financial transactions hidden from prying eyes. Amongst other things, I buy gifts with Monzo so I wouldn’t want the recipient of said gift to know anything about it.
If the phone itself its not secured then the app should be. If Touch ID or another form of biometric authentication isn’t available then I’d always recommend some form of secure manual input authentication like a passcode.
3 Likes
I’m very much in favour of additional security on Monzo’s client applications and at an API level. I’m also not suggesting that device level security replaces app and account security, rather that device level protection is a very important start to the whole security model. Any client side application security is completely untrustable if it’s sitting on a compromised device or OS.
4 Likes
Yeah actually a bank app should have security, I hope monzo is adding at least the option for fingerprint locking instead of having to use an easily uninstalled third party app
3 Likes
The one I posted cannot be uninstalled without finger print authentication
There should always be an alternative to fingerprint readers due to the problems people have with them if they work in certain industries or have certain impairments.
There are many people who suffer from skin diseases. Some of these diseases have a strong influence on the process of fingerprint recognition. People with fingerprint diseases are unable to use fingerprint scanners, which is discriminating for them, since they are not allowed to use their fingerprints for the authentication purposes.
The various diseases include Hand eczema / hand dermatitis, Fingertip eczema / fingertip dermatitis, Pompholyx / dishidrosis, Tinea of the palm / tinea manus, Pyoderma, Pitted keratolysis, Keratolysis exfoliativa, Lichen planus, Acanthosis nigricans, Pyogenic granuloma, Systemic sclerosis, Raynaud’s phenomenon, Medication induced adverse skin reactions, Leprosy, Herpes simplex virus, Scabies, Erythema multiforme, Dermatitis artefacta, etc, so it a bigger problem than may first appear.
2 Likes
Richard, I think you either missed the point of this thread, or you simply haven’t read the original post / beginning of this thread.
The point wasn’t that some of us want to see the fingerprint reader implemented, besides, not every Android phone got one, but the point was that Monzo, as financial application, has no second security at all.
I don’t care if it is via password, pin or whatever else the phone is offering. But I think it NEEDS some sort of second security and not just someone here from monzo suggested, have to rely on phone security.
It is not just about top ups etc., but sometimes my purchase history is none of anyones business. Even if I hand my phone willingly to someone for whatever reason and he just opens the app - none of their business.
But it seems for some reason that i have to keep defending additional security here - I don’t get it.
The above examples of fingerprint apps were merely a suggestion for people who seek security for their monzo app - either app supports password as well so fingerprint is not mandatory.
2 Likes
agree a PIN or whatever is needed but ao many iOS users keep harping on about fingerprint readers it is worth being aware of their drawbacks for some customers
1 Like
your point “It is not just about top ups etc., but sometimes my purchase history is none of anyones business. Even if I hand my phone willingly to someone for whatever reason and he just opens the app - none of their business.” is the one that strikes a cord with me
2 Likes
I think it needs an optional second form of security. Not everyone uses their phones in the same way, and for me, I’d rather the security was a pin etc on my phone, then having to login to the app every time I want to check my balance.
In the future when the app itself offers way to remove your money from your account it’d be comforting if some form of security was required for this sort of transaction.
5 Likes
Please please please do NOT make this extra layer of security compulsory!
By all means add the option to secure the app with a billion digit long password or the fingerprint of your left third finger and your right index finger or whatever else banks come up with next but personally, i do not see the point, other than inconvenience and a false sense of security.
My phone is protected by a PIN code already and by a fingerprint, why would i need to enter what lets be honest is going to be the SAME PIN code to unlock the app or use the SAME FINGERPRINT to unlock the app that i have already used to access the phone. If you don’t have any security on your device then that’s another story entirely but that is your choice and if my phone fell in to the wrong hands without a pass code, i think an unsecured monzo app would be the least of your worries with the amount of other personal information that can be accessed and used to steal your identity within your emails, text messages, phone book etc. or even having access to your emails would allow someone to reset your other accounts passwords!
Okay so rant over now, my point being yes, implement an extra layer of security by all means but don’t force it on us all!
Ash
2 Likes
Should be optional. Different people, different habits
1 Like
@ArcticAsh - rant
@Gojaba - summary
I agree with you both entirely, either way you put it. I don’t think it was ever suggested that additional security be compulsory. Although it’s easy to see where the idea comes from based upon other banks cough HSBC cough forcing absurd security measures upon users.
1 Like
Apologies 
< /Rant>
1 Like
It would be possible to encrypt data using a keypair stored in Android’s Keystore. This could then be unlocked via the fingerprint on supported devices, or via the phone’s password as a fallback (using setEncryptionRequired), or just automatically unlocked without prompting the user. The key would then be inaccessible to other apps, assuming they do not have superuser access (i.e. the phone isn’t rooted).
FingerprintManager handles the fingerprint auth, and a scheme like the above could provide marginally increased security.
Ultimately I think the title of this thread is misleading though. There isn’t an actual security vulnerability being disclosed, it’s the user’s fault for not securing their device. Even with the scheme I described above, if physical access to the device is obtained you’re probably screwed - it’d be a case of reading the data stored in /data/misc/keystore/user_0 if this is working how I think it is. It’d be non-trivial to do, sure, especially if the phone is encrypted (because you’d then need to do a cold boot attack or something to recover the disk encryption key) - but it’s still a possibility.
1 Like
Changed thread title to better reflect discussion, and moved into Android section. Hope that’s ok!
1 Like
While a lack of in app security makes it pleasantly accessible, what could be nice is optional security features e.g. Pin code/ 2 factor authentication after a phone restart, or a push accept/deny notification for a user adjustable amount, so my daily grocery shopping wouldn’t be stopped, but booking flights or buying something expensive would require more verification.
Security needs to be easy though or you compromise useabilty.
Smile have just upgraded their desktop login. Now need case sensitive username, secure password and 6 digit PIN. I am now locked out.
To reset requires use of security keypad thing which is in the bottom of a drawer somewhere and will require effort to go find.
Result that I’m not bothering to reset until I really need to use the desktop interface.
Such security is IMO over the top, and just pisses off the user and either means they find another service to use (Monzo) or you need to compromise your security by writing stuff down.
3 Likes
You do make a good point about physical devices used solely for the purpose of occasional authentication. I hate them. I like apps like Google Authenticator as it’s on my phone, so no need to rummage at the bottom of my drawers 
I would NEVER write my passwords down anywhere though. I don’t know any of my passwords except one, which is for LastPass. It’s data is stored in the cloud and encrypted/decrypted by my password, which isn’t stored anywhere. Even then I have 2 factor authentication every 30 days or on new devices before I can even gain access to find my password in there in order to sign into other sites. Probably hyper OTT but very secure, easy process to remember. Just a crap ton of hoops to jump through.
I’d rather a nice stable balance between security and usability, but if I had to choose one then I’d choose security.
2 Likes