SC95, why do you say the app isnāt secure enough? Things that are a significant security risk, like setting up new payments are protected by the card PIN to provide 2FA.
Wouldnāt it be a bit silly to then protect that same card PIN by only the app? Iām not saying the OnFido process is brilliant for this, the fingerprint verification on iOS is a much better option here, and I wish theyād gone that route on Android, but stillā¦ donāt take it as a sign the app isnāt secure enough. Itās secure enough for its function, but it isnāt secure enough to protect the card PIN since the card PIN then, in turn, protects functions requiring more security than the app alone.
I actually consider it very well-designed overall. It uses real security where needed, with none of the ridiculous security theatre most banks have. Great job, Monzo!
I have been against extra layers of security and have had a lot of arguments on this here so donāt think you got my point. I am saying it feels like Monzo donāt feel that App is secure enough hence these long-winded security and identity procedures.
I have found Monzo COps pretty rigid about these even when they donāt make sense so bit annoyed with my experiences these days with Monzo a bit.
Sorry, I was referring more generally to peopleās complaints the app isnāt secure enough. But, did you read what I wrote in detail? Basically, the app canāt protect the PIN because the PIN is used to protect things the app isnāt considered secure enough to protect. This is very reasonable.
Iām not saying OnFido is the right answer, I think they got this balance a lot better on iOSā¦
I understand what you said and agree but like you said just donāt agree with the whole process they need to speed up Android development I guess itās just is not pretty and necessary.
I hope this is replaced with Fingerprint verification when itās ready for Android. I hate taking selfies, let alone a selfie video. (Not to mention fingerprint is a lot faster).
And cheaper for Monzo. I find it amazing they implemented it this way, there must be some concern with the Android biometrics API for them to not only hold it up this long, but to spend time implementing thisā¦
Exactly what I have been trying to make senseā¦ But canāt WHY this why not just leave as it was and spend time on some other useful stuff like biometrics verification instead.
Then there is this fee Monzo have to pay for this serviceā¦ We are being told topups cost Monzo, overseas withdrawals do aswell hence fees but they are happy to spend on pretty lame implementation for a PIN recovery
Agreed 100%, though PIN recoveries are, to be fair, quite rare things.
Thatās whatās really confusing meā¦ looking at the API documentation, itās a seemingly simple thing to implement. Perhaps Monzo doesnāt trust it for some reason?
Not really, itās just an API call either way, and probably far more testing with the OnFido stuffā¦ All the ānewā bits - the actual PIN recovery screens and all that would be very similar.
Fingerprints not being universally supported is an issue, yes - but testing?.. I donāt see it. They have to test how either one behaves with the new PIN recovery screens anyway. Remember, theyāre not writing a fingerprint auth system, just asking the one Google has given them to check a fingerprint.
I am not expert but donāt most biometric security implementation come with a fall back on a PIN or password so if a phone doesnāt support biometrics it can automatically go onto PIN I know not too great but most new Android phones now are equipped with biometrics
The client-side API may be easy but we would need to rebuild a significant chunk of the service to support it. There are big changes coming to authentication and trusted devices coming to both platforms though!
As for the current PIN recovery flow, everybody is currently being put through the entire full flow every time. We will be iterating on this early next year but committed to shipping the very first version in Q4 2017 to comply with changes to PIN security requirements (from January, this system through the app will be the only way to retrieve your PIN, though there will be other verification options).
Additionally, there are a few assumptions in this thread that while it is not within my authority to call out specifically, are not true.
