Slashdot Mirror
Banks Begin To Use RSA Keys
jnguy writes "According to the New York Times (free bacon required), banks are begining to look into using RSA keys for security. AOL has already begun offering its customers RSA keys at a premium price. Is this the future of security, and is it secure enough? How long before everyone needs to carry around 5 different RSA keys just to perform daily task?"
I'm rather surprised: Several Norwegian banks have been using these RSA Hardware Tokens for a couple of years.
http://virtuelvis.com/
The article is really talking about using hardware tokens for extra security since the private data is stored on an external token and can't be stolen by viruses, trojans, or phishing scams. I don't even see RSA mentioned in the article -- there is an inset picture of an RSA SecurID but that's as close as it gets.
My bank (SEB, www.seb.se) has been using a hardware token system for years. I click the sign in button, enter my birthdate, receive two four-digit numbers, start the little device, enter my password and the two numbers and get a six-digit number that I enter in the login page and then I get logged in.
Is this somehow different?
Oh, and by the way, works like a charm and I feel a lot more secure than I do with static passwords
How long before everyone needs to carry around 5 different RSA keys just to perform daily task?
How long before everyone needs to carry around 5 different physical keys? Let's see... we have the house key, the car key, the shed key, the bike key, the gun case key, the baseball card key...
This sounds like SecureID cards, which are time-synched to a master server which runs the same algorithm/seed. SecureID has a long history in the IT world, and works relatively well (and, as far as I know, no one has ever hacked the algorithm).
Sounds like your device just calculates a response based on two inputs; don't know why that wouldn't be just as easy in software. (You _can't_ turn a SecureID card off, so it can't get out of synch with the server, unlike software.)
Not to say that your device isn't secure - more reverse engineering would be required to determine that - but the two approaches *are* very different.
If you're not living on the edge, you're just taking up space!
At first glance, the external token as described in the article sounds secure, but since the person only types it in once per login, phishing really isn't that much more difficult than before.
...
... sounds like that would blow #1 away, but not if the phisher then logs in via the victims machine.
Two ways off the top of my head a phisher can defeat this
1. Grab login data in real-time from an IRC channel, etc and race to login before the code changes - for extra measure, disable the user's connection for a little while - DoS, etc.
2. Proxy the request - that is don't try to steal the login data itself, but rather hijack their session and go to town.
Some may think, ok "check the person's ISP (IP range, etc) too"
In a nutshell, if the client machine can't be trusted, all bets all off!
Yes, tokens raise the bar, but I fear banks will use this more as an excuse to erode consumer protections for fruadulent transactions; Verify by VISA comes to mind.
Ron
To answer the 5 tokens keychain question: there is a software token device also available: http://www.rsasecurity.com/node.asp?id=1313/
I've been using physical tokens to log on to e-banking for years. Not only that, but tokens that are significantly more secure than securID fobs, in that they support challenge/response and using a PIN to unlock it (two-factor security, and the PIN is only used with the token so it needn't be known at all to the bank).
In fact, most banks are now switching to keypads that you plug your existing bankcard in, so they can piggyback on the tamper-resistant chipcard that's already on there (although it's slightly less advanced than some tokens, since chipcards don't support a clock that's permanently ticking).
Most devices are from Vasco who provide a wide range of tokens (some more secure than others). They even have challenge/response tokens that don't require you to copy the challenge; they have optical sensors that can read out a code that's blipped out by flashing blocks on your screen. Way cooler devices than those RSA securIDs.
SCO employee? Check out the bounty
http://www.nytimes.com/2004/12/24/technology/24onl ine.html?ex=1261544400&en=7cc80182b7687ad9&ei=5090 &partner=rssuserland
(Link created by the NY Times Link Generator: http://nytimes.blogspace.com/genlink )
Therefore, why are customers expected to pay $10 for these? Certainly, banks will recoup the costs somehow (through higher fees in general), but isn't the net effect of this type of technology supposed to be a savings? Isn't it the bank's responsibility (and liability) to make sure their customers' accounts are secure (assuming a reasonable amount of due diligence by said customers)? Isn't the savings in reduced fraud and security breaches supposed to outweigh the cost of the security devices? If not, why does the technology exist?
It sounds great and all, but unless offered as a free service, I'll sit this one out.
All of which is irrelevant. If China (or any other country) wants to get hold of a few hundred PCs to build a clustered supercomputer it's just not that difficult to do. Cripes, if Iraq can get hold of nuclear tech how hard can it be to buy a few commodity computers (or even high-end processors) on the open market? Why is this even a question?
I mean, sure, China has openly ripped off numerous technologies from a number of countries to bootstrap their high-tech economy, but to say that our banking industry is in danger specifically from China because they can (holy CPU chip, Batman!) build a Beowulf cluster is sort of ridiculous. China is a significant threat to the Western world, for a variety of reasons, but I'd say banking fraud is probably not one of the biggest ones. I'd be more concerned about Russia or Nigeria.
The higher the technology, the sharper that two-edged sword.
I call FUD. I've worked in banks (and credit unions) as a network admin for over six years, and that is some bullshit.
Now, understand that banks will use your information any way they can in-house, manipulate numbers and deposit totals and anything else analytical so they can sell a credit card or a loan (its called cross-selling). But what they cannot do is give your information to other 3rd parties without your direct consent unless its under federal mandate and/or decree (read: court order and/or the Patriot act).
Now this is all fine and good, but when you do something substantial with your money and/or your financial outlook (say, investing or buying a home), you open up yourself to offers from 3rd parties. You sign a document saying so.
Now the easiest thing is, before you sign something, ask them which companies are going to be behind this new venture. Whether it be an investing house (a lot of banks will farm out investing to a subsidiary and get kickbacks on it) or mortgages (who owns this loan? Can they sell it to a 3rd party mortgage company at a later date?), you need to simply be aware.
Feel free to google "Bank Privacy" and read up on the hometown banks and the big boys: They all pretty much say the same thing. If they are under FDIC (for banks) or NCUA (for credit unions), they all fall under the same guidelines: Your information cannot be shared unless you say so. The federal privacy statements which are mandatory to be handed out upon opening an account, etc, say the same thing.
Offshore data management services is simply a scarier way of saying Disaster Recovery. You want your bank to keep running even if the home office (or data center) explodes, right? Then don't start bitching about them backing up data in different places.
"The reality is that the RSA key is a godsend for protecting your accounts. Many Americans are simply unaware of the fact that the Taiwanese have essentially given all the key computer technologies to mainland China. Beijing can now assemble a supercomputer based solely on the technology from Acer, a Taiwanese company with major investments in mainland China. This supercomputer can easily crack the passwords of many accounts at your bank, brokerage, etc.
The RSA will help to protect Western bank/brokerage accounts from Chinese theft. That the majority of stolen credit card numbers end up in the hands of Chinese gangs, aided and abetted by Beijing, in Southeast Asia should surprise no one."
Nice troll. The fact is that the Chinese, as well as *the rest of the world* have had access to computer technology equivilent to that which exists in the US for *years*. There's nothing new.
Moreover, you don't use a "supercomputer" to crack bank accounts. The fact is, you can't brute force the passwords on bank accounts unless you are able to steal the password hashes - and by then you've already broken the system.
Bank accounts are being stolen using phishing, not supercomputers.
I've always thought that what we really need is devices like this with an LCD display that tells you what, exactly, you are signing.
:)
For example, imagine paying for some goods with one of these devices vs. credit card or smart card...
Smart card: You must trust that the card reader will not choose to use your card to sign things you didn't agree to. The reader could, for example, overcharge you, and you would have no way to know that it did until you checked your monthly statement. (And, hey, by that time, do you even remember if that item was $59 or $69?) For that matter, the reader could very easily make the charge under a different name, making it difficult to determine who committed the fraud.
Credit card: In addition to the smart card caveats, you must trust that the entity reading your card will not distribute your credit card number to any entity whom you don't trust at any time in the future. For that matter, if you use the same credit card with multiple entities, you have no way of knowing which one leaked your number. How can you fight back? Who do you charge with fraud or neglegence? In most cases you just let them go and your credit card company covers the illegal charges, while the FBI spends massive amounts of resources in mostly fruitless efforts to track them down. Why do we use these things?
The device I described: The LCD screen displays the question "Authorize payment of $59 to Acme Co.? Yes/No". No charge can go through without your device approving it. You only need to trust that your device will ask you to confirm any charge. And you can trust it because the manufacturer knows that if it screws up, they'll get their pants sued off.
The only thing that could make it more secure would be to implant the device into your body so that people can't steal it. Though, it's probably better to just deal with having to revoke a cert once in awhile rather than have people cutting you open to get to your bank account.
I know its probably too late for anyone to see this, but here's what my typical day looks like:
Wake up. Power on computer, wash up while booting. authenticate with windows. Launch Outlook, authenticate with Exchange server. Hibernate computer. Grab cell phone, wallet, keys, etc.. Leave apartment, authenticate with locks on apartment door. Walk to car, authenticate with car door locks. Get in car. authenticate with ignition. Drive to work. authenticate with cell phone, call voice mail, authenticate with voicemail, hit speakerphone and listen to messages. Lock phone. Park at work, lock car.
authenticate with front door at work. Greet co-workers. Sit down at desk, turn on monitors, authenticate with computer. Launch Outlook, authenticate with Exchange. Call voice mail from work phone, authenticate with voicemail. Listen to messages, hang up.
Terminal Service to Exchange server, authenticate with server. Launch MMC, check event logs, Exchange logs, IIS logs, backup logs. Check performance monitor. Launch Exchange Anti-Virus. authenticate with Anti-Virus program. Check logs. Minimize terminal service session with Exchange server.
Terminal service to SQL server, authenticate with server. Launch MMC, check event logs, SQL logs, IIS logs, backup logs. Check performance monitor. Minimize terminal service session with SQL server.
Launch firefox, browse to sharepoint, authenticate, read messages. Browse to gmail, authenticate, read messages. Browse to online bank, authenticate, check balance. Browse to credit card, authenticate, check balance. Browse to photography community message board, authenticate, check private messages. Browse to Slashdot, authenticate, check headlines.
Get call from manager, talk about project. Browse to file repository, authenticate, download requirements document. Browse to print server, authenticate, print requirements document. Write notes on project, browse to project worksite, authenticate, upload file.
Get call from user, walk user through troubleshooting steps, walk user through remote assistance request steps. Launch messenger, authenticate, receive remote assistance request. Initiate connection with VPN server, authenticate. Launch remote assistance application, connect to remote user, authenticate. Troubleshoot problem. Maximize Exchange server terminal service window. authenticate with locked screen saver. Open MMC, reset user password. Disconnect from remote assistance request.
Browse to network share, authenticate, copy backup files to removable hard disk. Logoff from terminal service sessions and local machine. Grab hard disk and leave office. Lock office door. authenticate with car door, authenticate with ignition, drive home. authenticate with apartment door, turn on computer, authenticate, launch outlook, authenticate with Exchange, read messages. Grab bike and leave house. authenticate with front door. Ride bike to gym. Lock bike in parking lot. Work out. Leave gym, authenticate with bike lock. Ride home. authenticate with mailbox, get mail, lock mailbox. authenticate with front door.
Its now 6:00 and I've authenticated with something or another 40 times. My day is only half over. I carry 8 keys in my pocket, and about 40 different passwords in my head. I am constantly locking and unlocking various things. My case may be a bit more extreme being a system administrator but trust me you do this too, and its probably just as bad. This was just a quick summary, I'm sure I left off about 100 other authentications. Welcome to Earth.
Im dreaming ofa big bndwdth, That can resist the
I'd like to be able to use just the one key for all the secure sites I go to.
... and I'd like that to be my OpenPGP key.
Surely it must be possible for me to give my public key to a bank (or whatever) and have them authenticate me using that key. e.g. by them sending out a hash, having me sign it using my private key, and then having them check that the signature is good.