My online bank created an app which can be used to generate TANs or be used as second authentication factor. For the setup it asks for the screen lock PIN which I've never seen before and seems like a bad idea (the equivalent of running an application not only with sudo, but entering the sudoers password into the application on Linux which I'd never do and alert the distributor of the application about potential malware).

Is this comparsion approximately accurate? And thus the use discouraged, maybe even requiring to take the app down? I could ask the app author, but they'll likely provide a biased argumentation.

I verified with the bank's customer service that it requires the screen lock PIN.

I'm using Lineage OS 14 based on Android 7.1.2 with Google Apps installed.

  • AFAIK the app should not be able to use this pin as it can only be used on the lock screen which the app can't access.The only usage I could think of is to test for complexity and therefore determine if your device has been secured or not. – Robert Jun 8 '18 at 17:49
  • 2
    I'd tell the bank that's a bad idea. IMHO your comparison fits. To determine whether the screen is locked or not, there are APIs that can be used by the app ("Keyguard"). I see no reason why an app should know the device lock pin or password. And I'd never trust an app which accesses the Internet with my passwords. But then, I'd neither do banking on my mobile device. – Izzy Jun 9 '18 at 18:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.