16 ms·
I can't speak for all banks, but I'm with Barclays in the UK, and their system makes keyloggers a non-issue in a similar way. I can login to "basic online banki
by corin_ 16y ago
I can't speak for all banks, but I'm with Barclays in the UK, and their system makes keyloggers a non-issue in a similar way. I can login to "basic online banking" using a few things from memory (surname, online ID number, debit card number, date of birth and password all required), but to actually do anything (like send money to another account) I need to authenticate using a chip+pin machine that they sent me free of charge. I insert my debit card, enter my PIN, then it gives me an 8 digit number that's time-sensitive. Frankly, this annoys me, why can't the reader connect via USB to save me typing in that number?
And I know at least one American bank has the same thing (possibly Bank of America?), as a friend of mine was the guy who pretty much created all of it.
- bryne 16y agoThe reader connecting (and transmitting) via USB would sort of defeat the secondary-device security point, wouldn't it?
- corin_ 16y agoPossibly but... would still be a lot more complex than just having a password. For example a standard keylogger wouldn't pick it up.
- rwmj 16y agoThat's security through obscurity. All existing techniques have been attacked (eg. keyloggers now take screenshots to defeat the silly pull-down menu "security"), so it's only a matter of time before they start capturing USB output and using it to attack the account in real time. What's wrong with a key fob displaying numbers with no physical connection to the computer? Edit: The first UK retail bank to offer this as standard would definitely get my custom. I'm quite serious about that. Also drop "VerifiedByVisa" nonsense at the same time and replace it with similar real security.
- ZoFreX 16y agoNatWest require the secondary factor if you either add a new payee or send a payment for the first time to a particular payee. You can still login and do almost anything else without it, though.
- mfukar 16y agoAt least two banks here in Greece use a similar system (it's essentially a two factor authentication variant). Connecting it via USB would defeat the whole purpose of this second trusted information channel, between the OTP device and the bank's customer.
- StavrosK 16y agoI think they all do, nowadays. The only reason I don't need a keyfob for my Alpha account is that when I opened it, 9 years ago, they didn't have keyfobs. Their password policy was retarded, though, it wouldn't accept a $ in the password. Of course, you can't do anything without the keyfob now other than view the balance and pay some bills, so it's okay.