Hacker News Reader

Which bank? It's a 70/30 between ING and Rabobank for me.

https://www.security.nl/posting/34165/%22Beveiliging+ING+mob...

> "Het authenticatie protocol ziet er goed doordacht uit. Er wordt niet vertrouwd op SSL of TLS. In plaats daarvan gebruikt ING een extra encryptielaag waarvoor het wachtwoord wordt afgesproken via het SRP protocol. Ook genereert elk mobiel device een eigen profileId en een public/private sleutelpaar", merkt Van den Berg op.

In English:

> "SSL/TLS isn't trusted, instead, ING uses an extra encryption layer the password of which is negotiated using SRP. In addition, every mobile device generates an own profileId and a public/private keypair"

Assuming SRP refers to this https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...

Rabobank was the one with the horrible non-native client so pretty sure he is talking about ING :)

Don't know if op was indeed talking about ING, but their app was, for a time, very wrong on Android as they seemed to have rewritten it on a Cordova/Phonegap stack which subsequently tanked their rating on the play store. Looks like they have released a new native version since then - at least on the french store.

There are many ING apps in the marketplace. Almost one for each product type and country. The comments above refer to the Dutch version.

Reply on news.ycombinator.com