Help me understand Active Security Keys

[Gillbot]

Ok, after my discussion with ebay support over my Active Security Key See HERE for my rant and arguing with ebay support over the obvious hole in said security, I want to understand better how these work/are supposed to work. One MAJOR flaw I see now is with the ebay change password system. I put in a request to change password and ebay send me a link via email. Using this link I changed my password without knowing the Active Security key and ebay let me right in, didn't even ask me for the key.

I have a SecurID for work and no matter what I cannot access our network without it. It randomly generates a new number every 60 seconds or so and that coupled with a password should keep an account reasonably secure. This is what the Paypal key is SUPPOSED to do I'd assume. Somehow someone managed to gain access to my ebay account without it. Even IF they had the key, they would have to get access to my password. How in the heck did they get in?

 

[spidey07]

It's basic two factor authentication, your username is something you know. The e-mail is something you have (in addition to the security cookie stored by your browser). You don't need another form of authentication via your rotating key (something you have).

Phishing, using ebay on unsecure or public wireless, malware, etc all of these could get somebody your username/password and possibly your security challenge answers.

 

[Gillbot]

I still fail to see how (with this key) that they could gain access to my account which is why I want to understand how they work.

 

[spidey07]

Originally posted by: Gillbot
I still fail to see how (with this key) that they could gain access to my account which is why I want to understand how they work.

I don't think it is quite sinking in yet. Google two factor authentication to understand. There just simply isn't any extra security provided with the change password system to use your key - the email + cookie + username is already two factors. Adding another is still just two factors so it's just not necessary.

So the password change is fine as it is. Your other concern is regarding a poor implementation of the authentication by ebay/paypal where somebody didn't need your key to gain access - they only needed your username/pass and possibly a security question.

Your secure ID is yet another example of two factor authentication - something you know (PIN), something you have (one time password token).