comdirect photoTAN App Security & Privacy Scorecard
by comdirect bank AG · iOS
Your banking activity stays on your device: no advertising, tracking, or analytics companies receive your data. Firebase is present for push notifications but is fully configured to collect nothing about you. Your authentication data is stored locally using hardware-backed protection tied to your device.
Best for
comdirect customers wanting secure mobile TAN
Findings
- 0 critical
- 0 high
- 2 medium
- 1 low
- 3 info
1 issue identified across security and privacy analysis.
Top security issues
- Mock OAuth tokens and banking customer IDs (kdnr, bpid, kontaktId) bundled in production app IPA accessible via backup or extraction
- Biometric authentication state flags stored in unprotected UserDefaults, allowing auth-flow manipulation on jailbroken devices
- No NSFileProtectionComplete entitlement — unencrypted transient files accessible to forensic tools on physically seized devices
Top privacy issues
- Internal TrackingService transmits app interaction events linked to personId/userIdentifier to comdirect backend
- Remote telemetry may include fully instantiated request URLs containing customer identifiers (kdnr, activationId) in log pipelines
- Universal link wildcard (*.comdirect.de) expands the app's deep-link handling surface beyond necessary scope
Full analysis
Comdirect photoTAN
What This Means for You
Test banking account numbers that follow real comdirect account patterns are bundled inside the app and can be read by anyone who extracts the app from a device backup.
Recommendation: Use With Caution
Strong security controls protect your authentication data, and your data stays entirely within comdirect's own systems. However, mock banking customer IDs bundled in the app increase risk if the app file is extracted or backed up. Comdirect customers who understand this limitation can use the app safely for TAN generation.
Best For: Comdirect banking customers who want a dedicated TAN generator with strong authentication controls and no third-party data sharing.
Key Findings
Data Security - 3 findings (2 medium, 1 low)
Network Security - 1 finding (1 info)
Code Safety - 0 findings
Privacy - 2 findings (2 info)
Privacy Concerns
What Data is Collected
- Account activity: screen views and authentication interactions linked to your account identifier
- Diagnostic data: operational error reports sent to comdirect's own servers
- Device information: device identifiers used for secure authentication binding
Third-Party Data Sharing
The following third parties may receive your data:
- Google (Firebase) - push notification delivery only
Understanding the Scores
Security: 91/100
Privacy: 99/100
Security Breakdown
- Data Security: 88/100 - Test banking account identifiers are bundled in the production app; biometric setup preferences are stored without full protection
- Network Security: 100/100 - All network traffic uses enforced secure connections with no exceptions configured
- Code Safety: 100/100 - No dangerous code patterns detected across all analyzed binaries
Privacy Breakdown
- Data Collection: 100/100 - Only collects data necessary for authentication and TAN generation
- Data Sharing: 100/100 - No data shared with advertising or analytics companies
- User Control: 100/100 - Privacy disclosures are complete and accurate
Positive Security Features
- All network communications use secure connections with no exceptions
- Your authentication data is protected by hardware-backed device binding that ties it specifically to your device
- Biometric authentication keys are invalidated automatically if you re-enroll Face ID or Touch ID
- Local app data is stored in a strongly encrypted database
- Usage analytics and Firebase Analytics are fully disabled
- No advertising, tracking, or analytics companies receive your data
- No advertising identifier is accessed
- TAN codes are derived on-device with no network dependency for the core cryptographic operation
- Backend database access requires authentication - unauthenticated access is blocked at the server
- Privacy disclosures are complete and accurate, covering all required data types
Areas for Improvement
GDPR / CCPA Compliance
The app's privacy practices could be strengthened by:
Removing Test Data from Production Builds
Mock banking account numbers and session data should be excluded from released app builds to avoid bundling identifiable account patterns in files that can be extracted from device backups.Protecting Biometric Setup Preferences
Authentication state settings should be stored in protected system storage rather than general app preferences, preventing manipulation if device storage is accessed directly.
Security Enhancements
Stronger File Protection at Rest
Enabling the highest level of iOS file protection would ensure that even temporary or cached files remain inaccessible while the device screen is locked, not just after the first unlock following a reboot.Request URL Logging Precision
Confirming that operational error reports use URL templates rather than fully constructed addresses would prevent account identifiers from appearing in server-side log pipelines.
Technical Context
App Type: Financial - banking TAN generator, high sensitivity
Classes Analyzed: 149
Third-Party Services: 21 libraries identified (cryptographic, networking, and notification frameworks)
Context Tags: financial, sensitive_data
About This Analysis
This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.
App Details
Developer: comdirect
Version: 9.11.0 (build 3654)
Analysis Date: 2026-04-11
Package: de.comdirect.phototan
Analysis Limitations
- Static analysis only (code review without running the app)
- Based on iOS app version 9.11.0 analyzed on 2026-04-11
- May not reflect server-side security controls
- Cannot detect all runtime behaviors
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 93/100 |