4 ms·
It annoys me that a trick is missed with the secure fob. Imagine that: the challenge screen includes the amount you are authorising and you type that amount in
by adrianhoward 14y ago
It annoys me that a trick is missed with the secure fob. Imagine that: the challenge screen includes the amount you are authorising and you type that amount into your secure fob along with the challenge code
That's basically how the auth works on with my online bank. I get a small calculator sized device that reads my debit card. I have to enter the card pin, a challenge code from the online transaction, and the amount - which then gives me a code to authorise the online transaction.
(The downside is that the devices are all identical - so anybody with one + a cloned card + my stolen login info can auth transactions - hey ho...)
- 3pt14159 14y agoThat is beyond stupid. Why not have different signing/encryption keys on the individual fobs?
- adrianhoward 14y agoCost/benefit I imagine. It makes the widgets much simpler to manufacture, distribute and use. And the risk, from what I can see, is pretty low. It would have to be a very focused attack to clone my card & get all my auth info for my online banking account since the two sets of data (card + online auth) don't intersect anywhere normally.
- rwmj 14y agoWould you even trust the lowest-bidder factory where the card readers are made?
- adrianhoward 14y agoThe factory isn't really an additional risk. There's not a networked man-in-the-middle attack via the readers (they're not connected devices). You can't change the algorithm (it needs to be the same one implemented by the online bank). The algorithm is already essentially public (the devices are identical and widespread). Pwning the factory doesn't really give an attacker an advantage.
- miahi 14y agoDoes it read your card (magnetic strip) or it uses the card's chip for encryption services to generate the tokens? It's not the same thing. Card chips are not easy to clone and have more data than the credit card number.
- adrianhoward 14y agoGood question. No idea :-)
- brey 14y agoare you talking about the barclays PINsentry? if so, it's a chip reader.
- adrianhoward 14y agoNationwide's box. I don't have one to hand to go look.