Hmm interesting read. In Sweden there is a thing called BankID and basically you can use your mobile device as a universal authenticator. Of course, you need to have the device and enter a 6-digit pin, but I often wondered how dangerous it was to use this so much. And on top of that I know people that used it in local cafes on public WiFi.

I would love to do an examination of communication via BankIDs app to the internet to see what kind of security exists to protect the user. If you can get the person's social number (personnummer) and their 6-digit code, then spoof their device (probably the easier part) you can basically take over their life in Sweden.