More fallout from phishing... two-level authentication required by end of 2006

[kranky]

By the end of 2006, you won't be able to log on to your bank's site with just a username and password.

Banks are required to implement two-level authentication, meaning that not only will you will have to supply a username and password, but you also will have to use a second method to keep phishers from accessing people's accounts.

There are a number of different methods that will satisfy the requirement.
- Card readers which generate a password when a card is swiped
- Tokens, which can plug into a USB port
- Password generators that create one-time use passwords
- Fingerprint or retinal scanner
- Scratch-off cards that have a series of one-time use passwords

The bank gets to choose the method that will be used.

I feel bad for people who have accounts at multiple banks.

 

[Kipper]

Source?

I wonder who's going to pay for this...something tells me consumers will pick up the tab.

 

[Specop 007]

Most of that sounds like a hardware solution, which I imagine cause a bit of a fuss from the general public. I know I personally do NOT want to pay for additional hardware just to access my account online.
Also, what about other financial services online, such as ING or scottrade or a IRA account?

 

[kranky]

Originally posted by: Kipper
Source?

Link to Information Week story.
Link to 14-page PDF file from the Federal Financial Institutions Examination Council.

 

[Mardeth]

"Scratch-off cards that have a series of one-time use passwords." been using something like that for years already. No problems...

 

[Rubycon]

Tumbling passwords sent out to a cellphone every five minutes. When you need to log on, grab phone and enter code from phone. Lose phone or phone goes dead = no access.

 

[MrBond]

Originally posted by: Mardeth

"Scratch-off cards that have a series of one-time use passwords." been using something like that for years already. No problems...

Sounds like something you'd need to activate a nuclear bomb :shocked:

I think this is a good idea. I wouldn't mind paying for a fingerprint scanner so I could do online banking. I'm sure it'd work with more than one bank.

That'd also sort of eliminate the need for the password - unless the phishers start cutting off fingers or something (apparently it IS the russian mafia behind a lot of it...)

 

[Kelemvor]

Like the banks are going to shell out to give every one of their customers a VPN type token or a USb key or something. So much for FREE online banking if they have to do that crap.

 

[skace]

I want hardware for my PC, that sounds excellent (seriously).

 

[yllus]

Doh. Guess I won't be checking my account balance from work anymore.

 

[Specop 007]

I really hope this doesnt go through.
Such a horrible idea

 

[Injury]

The money would be better spent on teaching people to not be retarded.

 

[arcas]

- Card readers which generate a password when a card is swiped
- Tokens, which can plug into a USB port
- Password generators that create one-time use passwords

If these are standalone, then it's not too bad. Lots of corporate VPNs use standalone keyfobs which generate new PINs every 30 seconds or so. Standalone is good because it doesn't lock you into using a particular computer or a particular operating system.

The plug-into-a-USB port or card readers (which are presumably plugged into the computer) are bad because drivers for said device may not exist on the computer you're using. For example, as I recall, the old defunct Amex blue smartcard offered an optional card reader and app that generated new one-time CC numbers. This setup only worked for Windows (and maybe Mac) so BSD/Linux/BeOS/etc users were stuck using the online number generator on Amex's website.

Standalone is good. Dongles and other hardware-software combinations that rely on a host computer are bad.

 

[PingSpike]

Just ban stupid people from using computers instead.

 

[NeoPTLD]

I say little calculator like device which you put in a number and spits out another number that you type into computer works well. I've seen something like this used for a corporate network access password.

 

[yobarman]

Originally posted by: Injury
The money would be better spent on teaching people to not be retarded.

Word.

 

[marvdmartian]

Originally posted by: C6FT7
Tumbling passwords sent out to a cellphone every five minutes. When you need to log on, grab phone and enter code from phone. Lose phone or phone goes dead = no access.

Okay, what about the .00001% of us that are still in the "dark ages", and don't have a cell phone?? I have no need or desire to have one, and save $50+ a month by not having one. I used to have one, figured out one day what a waste of money it was, and had it turned off.......and I've never been happier!

Sorry, but I have to agree with the sentiment here that if you just spent the time, effort & money that will be spent on something stupid like this on just making people smarter and more internet/street savvy, we'd be better off. :roll:

 

[KK]

This is stupid, who's pushing this idea? Must be the government. Leave it up to the government to fvck something up. We should line up all the politicians and execute them.

 

[Anubis]

the bank shoudl just give everyone a FOB when they get an accnt, have it generage a random number every 15 seconds, mysister has one of them so she can log into work from anywhere

 

[skace]

Why is this so stupid? I wouldn't mind having a USB dongle. Although I hadn't thought of driver issues yet. But I was sort of hoping it would be a stand alone dongle, plug it in and it recognizes it as some sort of read only drive with special data on it / whatever. That would eliminate the possibility for anyone ever getting into your account (supposedly).

Now I'm not a "stupid user" but there is always a possibility that someone gets my PIN somehow, possibly through a new exploit that hasn't been patched that backdoored my machine and put a keylogger on. So if a cheap dongle can completely prevent that, I don't see what is wrong.

 

[rh71]

... and you thought the ING Direct "type the letters corresponding to your PIN" authentication was a PITA... this sounds like it will be much more troublesome.

 

[randomlinh]

Originally posted by: Anubis
the bank shoudl just give everyone a FOB when they get an accnt, have it generage a random number every 15 seconds, mysister has one of them so she can log into work from anywhere

friend's dad works for the treasury.. or some sub department of it, same thing. I wouldn't mind this... on top of the username password.. wouldn't want to lose it and have someone access my account with it...

 

[halik]

Originally posted by: kranky
By the end of 2006, you won't be able to log on to your bank's site with just a username and password.

Banks are required to implement two-level authentication, meaning that not only will you will have to supply a username and password, but you also will have to use a second method to keep phishers from accessing people's accounts.

There are a number of different methods that will satisfy the requirement.
- Card readers which generate a password when a card is swiped
- Tokens, which can plug into a USB port
- Password generators that create one-time use passwords
- Fingerprint or retinal scanner
- Scratch-off cards that have a series of one-time use passwords

The bank gets to choose the method that will be used.

I feel bad for people who have accounts at multiple banks.

There needs to be a standardized and centralized interface for all banks. If they agree on one protocol and one centralized spot to log onto all banks, it won't be an issue. That and stop sending email announcements with links of any kind. If people know that banks will never send anything clickable , they won't be an issue.

 

[halik]

Originally posted by: lnguyen

Originally posted by: Anubis
the bank shoudl just give everyone a FOB when they get an accnt, have it generage a random number every 15 seconds, mysister has one of them so she can log into work from anywhere

friend's dad works for the treasury.. or some sub department of it, same thing. I wouldn't mind this... on top of the username password.. wouldn't want to lose it and have someone access my account with it...

RSA makes those... they call them SecurID

 

[ironcrotch]

I dunoo about this, but BofA has had two level account access for a while now. Works pretty well, it's just a sitekey that contains an image with a passcode.