3 ms·
The same way you create any secure login system: Require long-ish complex passwords (numbers, upper, lower, and symbols, 8+ characters). Store those passwords o
by showerst 14y ago
The same way you create any secure login system: Require long-ish complex passwords (numbers, upper, lower, and symbols, 8+ characters). Store those passwords only as slow-to-generate hashes (bcrypt or the like) with a per-user salt. Run everything over HTTPS. Make sure your password reset system doesn't have some trivial bypass or information leak.
If possible, two factor authentication is preferable (whether via hardware dongle or smartphone app, a la' blizzard's authenticator), but that adds a ton of overhead.
- pbhjpbhj 14y agoYou can use the customers phone as the dongle, generate the one time code at the bank end and send it out-of-band as a text message. You could even have an app that takes the users location from their smartphone and does a loose check on geographic location of the IP being used. The bank end gets the GPS+IMEI or whatever, produces the one-time code and texts it to the user. The user then enters the one-time code and their password on the login screen - perhaps it's used locally to encrypt the password (to combat MITM) before sending over the https connection. For those without smartphones then charge for a dongle or have a phone based system that you can telephone (enter your postcode and get back the one-time code). ?