5 ms·
Banks in the UK have been handing out hardware fobs. Not USB devices you put in, but a calculator like interface where you input the challenge they give you and
by dalore 9y ago
Banks in the UK have been handing out hardware fobs. Not USB devices you put in, but a calculator like interface where you input the challenge they give you and you type the response back.
I guess it works since it doesn't need anything else special and can easily work with web flows.
- majewsky 9y agoI think you mean a ChipTAN generator. https://en.wikipedia.org/wiki/Transaction_authentication_number#ChipTAN_.2F_CardTAN https://en.wikipedia.org/wiki/Transaction_authentication_num...
- jon-wood 9y agoThe nice thing about these is that you do need something else special but that something else is your bank card, and the PIN used to access it.
- dr4g0n 9y agoOnly for some banks, e.g. Barclays. HSBC's version[1] does not require a card to use. [1]: https://www.hsbc.co.uk/1/2/contact-and-support/security-centre/secure-key/demos#physical-secure-key https://www.hsbc.co.uk/1/2/contact-and-support/security-cent...
- _joel 9y agoI've not used mine for some time now, as my bank offers the same function via the smartphone. Very handy though.
- dannysu 9y agoBanks in the US also hand out hardware devices, especially for business accounts. I have RSA token device from Wells Fargo for example. The problem with these is that I need a special device for every single account. There are two business accounts I have access to and I have to deal with two hardware devices.
- Latty 9y agoThe ones in the UK are a standard - every account I have uses the same ones and they are interchangeable. Everyone I know had one - they are ubiquitous as the chip and pin standard is here.
- berdario 9y agoI have 2 bank accounts in the UK, and neither of them provided an hardware fob. It's frankly a bit disappointing, since storing secrets in their mobile app means that at the end of the day, when you do banking on your phone, you're really using only 1-factor authentication
- Latty 9y agoThat's interesting - I have accounts with three of the major banks and all of them have me them (they do use it different amounts, some only for signing transfers, some for everything including logging in).