Difference between revisions of "Flicker"

Revision as of 14:50, 17 December 2017

This page is a collection of information about FinTS Flicker Code. The more official term is optical ChipTAN, another name is Sm@rtTAN.

Intro

Requests

Several users asked for it:

https://gnucash.uservoice.com/forums/101223-feature-request/suggestions/2654889-support-for-chiptan-comfort-smarttan-optic-flicke

https://bugzilla.gnome.org/show_bug.cgi?id=667490 - Support aqbanking feature: optical chip tan

Official Specs

http://www.hbci-zka.de/dokumente/spezifikation_deutsch/Belegungsrichtlinien%20TAN-Generator%20ve1.4%202010-07-23%20mit%20Erratum%201%20final%20version%20.pdf

http://www.hbci-zka.de/dokumente/spezifikation_deutsch/hhd/Belegungsrichtlinien%20TANve1.4.1%20FV%20vom%202017-02-08.pdf

http://www.hbci-zka.de/dokumente/spezifikation_deutsch/hhd/Belegungsrichtlinien%20TANve1.4%20-%20GV-VK-Mapping-Tabellen%202013-07-18%20final%20version.pdf

State: 2017-07-25

Possibility

It is possible to use the chipTAN mode without Flickr in Gnucash.

If your bank account is configured for chipTan you get a dialog with the information of the transaction and a <start code>. And you get the information how to input these informations into the TAN generator. then you generate the TAN to put into the field in the dialog.

State: 2017-12-17

Other Details

https://wiki.ccc-ffm.de/projekte:tangenerator:start has useful links like

• flicker.sh
• JS Flickercode generator with Checksum calculation: http://6xq.net/blog/2010/flickercodes/flickercode.html

Videos

Initialization: https://www.youtube.com/watch?v=mCmQFEGf-_k

Transaction: https://www.youtube.com/watch?v=U7PnC1S-j4I

Approaches

Programs

Olaf Willuhn's GPL2ed Java based Hibiscus has also a nice german wiki and other links.

A incomplete list of FOSS banking software

Modules

An MIT-licensed javascript implementation is available at https://github.com/my-flow/fintex/blob/master/lib/tan/flicker_code.ex

Security

Already in 2009 was shown that it is not totally secure against man in the middle attacks: https://www.redteam-pentesting.de/en/publications/MitM-chipTAN-comfort/-man-in-the-middle-attacks-against-the-chiptan-comfort-online-banking-system