14 ms·
I think using the password alone in the bank is a stupid idea in the first place. If all that stands between my dollars and miscreants is a few characters - thi
by ay 15y ago
I think using the password alone in the bank is a stupid idea in the first place. If all that stands between my dollars and miscreants is a few characters - this is careless to say the least. Think trojans/keyloggers.
My bank gives me a small card reader (not connected to PC), where I insert my debit card and need to put in my card pin. This gives a one-time code which I enter together with my password to login.
However, this is not all - in order to do anything meaningful (aka transfer money), I need a confirmation code, which is done by me typing into the little machine the amount, part of the account number being credited, and of course my banking pin to begin with. So, I effectively sign the transaction, and having the reader totally offline makes me somewhat confident in its security even if my linux laptop were compromised.
Of course all of this needs to be matched by the proper security rules on the backend, which, given their cluefulness with frontend, I trust them to have.
p.s. That said, indeed now I remember that the password rule they had is kinda stupid. But I have only one bank and I can make the exception for them, given that they have done their homework otherwise.
p.p.s. and no, I would not like to have my bank operations protected by the unlocked private key - the added convenience in this case is not worth the risk at all.
- icebraining 15y agoOurs just sends an SMS with a one time code for each operation.
- ay 15y agoThis is much better than password alone - and very nice usability-wise. But it significantly increases the area that you need to trust to be safe. I would not like to have it for all of my accounts. But would be cool if my bank used this system for transactions under 100 euro, for example.
- finnw 15y agoQuite a few websites I use offer this (usually in addition to a password.) I won't use it, because it means I will be locked out if my phone or SIM breaks. This could easily be fixed by having a backup phone number to use if the first one fails, but for some reason they never do that.
- nazar 15y agoAnd probably you are right. I can't use my internet banking of one Singapore bank right now. I am not there and cant receive an sms with one time password on my Singapore sim. It sucks!
- freehunter 15y agoSet up a Google Voice number and have the text sent there. GV can then forward that to your phone, so you have the convenience of getting it on your phone with the knowledge that you can get to it even if your phone is not working. My bank has an offering that lets you select between getting the code as a text or as an email.
- icebraining 15y agoOnly if you're in the US, unfortunately.
- namityadav 15y agoBank of America SMS doesn't work with GV numbers. I know .. I've tried it multiple times :(
- 7952 15y agoAt least with the Google system you can set-up one time codes that you can keep in a safe place.
- TeMPOraL 15y agoFew years ago my friend had an account in a bank that gave him security token, that generated a random number every 60 seconds, that had to be appended to password during login. So even if someone sniffed your password, it would be valid only for less than a minute :). I think it's a great solution and I don't understand why it's not widely used.
- ay 15y agoless than a minute is more than enough to transfer your money to a place where you will never see it again. ;-)
- kijin 15y agoLess than a minute is also short enough that the bank can simply deny a second login attempt during that time without causing any inconvenience to you.
- ay 15y agoAbsolutely. i got your TCP segment with data on your WIFi, and sent a TCP RST from a location with the lower overall latency - so both your SSL connection got reset. While you hit "reload", I establish the connection and login. Your attempt is the second login attempt. As you propose, it's denied. Your next steps, while I am changing your contact email and other info ?
- raesene2 15y agoShort answer from my experience is cost. The individual tokens have a cost, then there's the management overheads of running the system. Initially it doesn't seem like too much but if you've got a customer base numbering in the millions, it can get quite pricey. Obviously if the cost (to the bank) of online fraud gets high enough it starts to make more sense. What's interesting is that some online apps (eg, World of Warcraft) have seen the benefits of providing 2-factor authentication faster than a lot of Financial Services companies. 2-factor auth of one kind or another seems to me to be a good idea for online banking, given the prevalence of banking trojans which have keylogging functionality.
- Sami_Lehtinen 15y agoIt's really nice see that some banks and sites have good policies. But most of sites and banks got absolutely horribly bad security. Afaik, that's one of the best ones I have seen this far. It's especially important that part of target account is used to generate authentication verification key. Because using static or non-content sensitive confirmation codes is useless.
- ay 15y agoExactly - because all of those solutions do not take into the account the possible active keylogger which might interfere with the "authentication code". In fact I think here in Belgium there was an incident where chunks of money were stolen from people. I see what one of the commenters mentioned about the "extra gadget" - but I usually make internet payments at home - so no need to drag this gadget really. Plus, in theory I can use my friends' one - the gadgets are absolutely identical; the "something I have" part is on the card itself, which is in my wallet.