3 ms·
Yes, I use Barclays and have one of their nifty chip and pin devices. What if the "something you have" was your mobile phone?
by gstar 18y ago
Yes, I use Barclays and have one of their nifty chip and pin devices.
What if the "something you have" was your mobile phone?
- bd 18y agoMy bank sends me SMS with a PIN code when I log in. But they are in the process of replacing the system with a card reader that reads your debit card (smartcard with a chip).
- thwarted 18y agoAre you supposed to use this card reader from your computer at home? The SMS with a PIN seems more secure AND more usable, and has the added benefit that you get notified if someone else tries to login to your account.
- bd 18y agoIt's a small calculator-like device, more or less the size of the credit card. Their reasoning for why it's supposed to be better than SMS: a) you are not dependent on a third party (mobile phone operator), so that you couldn't access your account when there is no coverage, or your battery is dead, etc; b) with SMS you get authorization once per session, with card reader each transaction gets unique authorization (you have to enter a transaction details twice - online and in the reader). So even if somebody "listens in" to your traffic, they would be just able to reply your actions exactly, not use your credentials to do their actions. This layer of protection also exists for SMS solution, but it's limited as they use printed grid of codes for additional authorization of transactions. So that in principle if somebody hijacks your traffic for a long enough time, they would be able to reconstruct your static grid of codes. Or they could phish you to give your codes (it did happen, there is a big red warning on their homepage).