Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When i was dealing with an assistant of my bank through mobile call, she asked me to insert my bank login code after a beep.

I was wondering if this procedure is secure against a Man In the Middle attack. In this case, EVE would be listening to the call and get the sensitive data.

In Literature i found that GSM stream ciphers such as (A5-1,A5-2) are known to be weak.

Is it safe to send sensitive information such as a bank online account code through a voice call?

share|improve this question

closed as off topic by Paŭlo Ebermann Apr 2 '13 at 15:42

Questions on Cryptography Stack Exchange are expected to relate to cryptography within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

This question might be better asked in security.SE. From a cryptographic POV the answer is negative, for the reasons you state, but banks are known to take calculated risks for various reasons. That is rather a general security question than a cryptographic question. – Henrick Hellström Apr 1 '13 at 18:20
As this question was duplicated on Security Stack Exchange, I'm closing it here. In future, please flag a question where you think it should be better on another StackExchange site, so we can move it. – Paŭlo Ebermann Apr 2 '13 at 15:42
up vote 2 down vote accepted

Are you defended against a MITM attack? Certainly you are not well-protected. First, you have no assurance that the phone number you dialed was answered by a bank employee. The phone call could have been intercepted by an attacker, impersonating the bank. GSM encryption can also be disabled by an attacker, especially so on an iPhone which violates the GSM standard by disabling the "Warning! Unsecure call!" prompt. So it's possible your call could go out in cleartext to an eavesdropper.

But you asked a more important question: "Is it safe?" That's a risk assessment you'll have to decide for yourself. Do you know if there is an attacker interested in you, personally? Do you have vast personal wealth that would tempt a criminal? The level of sophistication required to perform a MITM intercept would have the attacker looking for millionaires to steal from in order to maximize profits while minimizing risks. If your bank account has only a few thousand dollars in it, you are probably not a valuable enough target to worry much about it.

Finally, to protect yourself and your money, you should look at using a bank with two-factor authentication, where you have a pocket token with a rotating number. The bank would refuse to deal with you unless you held the token, and you would refuse to deal with them if they couldn't authenticate themselves to you.

share|improve this answer
I've put this question on security exchange since it is more related to security than cryptography. Thanks for the response. – danieltorres Apr 1 '13 at 22:47

In short: No. Especially, you have to take into account that not always dtmf signaling is send in the voice channel. Often it's a outbound signaling. Gsm IS weak, but you can (very likely) set your mobile phone to use G3 instead of 2G which is not weak.

share|improve this answer
None of the GSM stream cyphers are still standing. Even if they were, attacks by a MITM tower work by telling the phone that encryption is not supported, and that the call should go through unencrypted, rendering all forms of encryption inactive. – John Deters Apr 1 '13 at 20:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.