Browsers & Carriers for Mobile Banking

When you begin to think about testing a browser-based mobile banking application you need to carefully consider which handsets to validate; however, that's typically the last step. So, where do you begin? Here's my recommendation:

1) Determine which carriers you want to validate. Obviously you want to start with the big 5 (ATT, Verizon, Sprint, Alltel and T-Mobile) but don't forget to also consider any local or regional players.

2) Determine which browsers are most critical to you. At a minimum consider the following: Blackberry, Blazer (Palm), Mobile/Pocket IE, Nokia, Opera & Opera Mini, Safari, NetFront, and Openwave. Quick Note: Openwave is the most widely sold browser of all time, but you will rarely if ever hear someone claim to be running the product. It appears that handset manufacturers simply purchase and re-brand the product.

3) Determine the handsets. Unfortunately, it's not quite as easy as it sounds. The challenge is trying to determine which handsets need to be tested on the respective carriers in order to cover all of the possible browser/carrier combinations. Additionally, I'd recommend taking it one step further and also cross referencing the handsets your clients are carrying. How do you accomplish that? Good old fashioned primary research - I'll cover that in another post.

Recommendation for Mobile Banking Vendors & An Update on Opera Browsers

I have an update to an article that I wrote last month titled "Opera Mini Browser & Mobile Banking." I stand behind my opinion that Opera Mini is a very powerful mobile browser, and my favorite for general web browsing. However, I have since learned that it is not conducive to mobile banking.

In fact, I received the following information from a reader:

"...one important thing to note is that Opera Mini provides inadequate security for Mobile Banking - the technology that Opera Mini uses results in the data being decrypted on the Opera server, very similar to the old "WAP gap" problem.

This is clearly documented on the Opera web site:

http://www.operamini.com/help/faq/#security

Is there any end-to-end security between my handset and for example paypal.com or my bank?

No. Opera Mini uses a transcoder server to translate HTML/CSS/JavaScript into a more compact format. It will also shrink any images to fit the screen of your handset. This translation step makes Opera Mini fast, small, and also very cheap to use. To be able to do this translation, the Opera Mini server needs to have access to the unencrypted version of the Web page. Therefore no end-to-end encryption between the client and the remote Web server is possible. If you need full end-to-end encryption, you should use a full Web browser such as Opera for Mobile.

Can Opera Software see my passwords and credit card numbers in clear text? What is the encryption good for then?

The encryption is introduced to protect the communication from any third party between the client (the browser on your handset) and the Opera Mini transcoder server. If you do not trust Opera Software, make sure you do not use our application to enter any kind of sensitive information."

Naturally my question back to the reader was, "Am I reading correctly then that Opera for Mobile is secure? Are there any other free, downloadable browsers that do provide end-to-end security?"

And the response -

"Opera Mobile is available for Windows Mobile and Symbian 60 phones. It is not free however - the cost is $24 after a 30 day free trial.

http://www.opera.com/products/mobile/products/winmobile/
http://www.opera.com/products/mobile/products/s60/

You can find a list of Symbian 60 phones here - make sure to search for the ones that are available in North America (note that the RAZR is not on this list):
http://www.s60.com/life/s60phones/browseDevices.do

I am not aware of any free downloadable browsers that provide true end-to-end security."

To bring this full circle -

It has become clear to me over the last 6 months that a significant number of bankers and research companies believe that a 3 channel offering (SMS, Browser-based, Downloadable) is the optimal solution. Yet, we know that many of the mobile browsers pre-loaded on phones are inadequate. Therefore, my recommendation is this. If you are a vendor currently offering a downloadable application, please find a way to incorporate a top-notch web browser into the download.