Mobile Authentication security on rooted device?

[Sami Lehtinen]

Hi, I'm curious about mobile authentication security. How well the SIM card TEE communication is secured with different parts, like mobile network and user interface & inputs?

I basically like concept of mobile auth & sign. But there are a few questions. Even if the trusted execution environment (TEE) software and it's secrets would be 100% secure, there's another problem, which is the actual device accessing the TEE module. How well the interaction between user and TEE is protected on OS level? What if device is rooted, what if it's operating system is backdoored? Are they still sure that this concept works flawlessly. If there isn't additional information about this protection, I would assume, it's not going to work and it is therefore inherently hackable. That's why having 100% separate hardware for authentication & message signing would be much more secure approach.

Reference to one service, which claims it's secure, but I really do have my doubts about it.

Reference service: Front page | Mobiilivarmenne

 

[Rukbat]

Rule of thumb - if the armed guard at the door can't be completely trusted, no device in the room can be considered 100% secure.

No device out in the world can be considered secure, regardless of the "security" software on it. Even Knox has security holes.