3 ms·
That's just a bigger password that they're instructed to keep a copy of then? If you're going to do that, just add a proper OTP factor like a SecurID token that
by endianswap 13y ago
That's just a bigger password that they're instructed to keep a copy of then? If you're going to do that, just add a proper OTP factor like a SecurID token that they can carry with them.
- MarkMc 13y agoYes a SecurID token is probably more secure than a piece of paper, but it is also less convenient and more expensive. Also, the piece of paper with 4 words will have 52 bits of entropy while a SecurID token with 6 digits has only has 20 bits of entropy. So I wonder whether SecurID would be easier for an attacker who has access to the password hash and salt to derive the original password...? In any case, whether you use a piece of paper or SecurID the main point is that financial sites which only require email+password are being negligent in their duty to protect user data from unauthorised access.