Slashdot Mirror
Secure Ways to Determine 'Something You Have'?
Steve Cerruti asks: "My credit union is implementing multi-factor authentication for online banking. They are following guidelines provided by the Federal Financial Institutions Examination Council as outlined in Authentication in an Internet Banking Environment (PDF). As you are already required to enter a password, 'something you know' is covered. 'Something you are' has significant technical hurdles while 'something you have' is familiar to credit unions in the form of ATM cards.
My credit union chose to implement 'something you have' as a two dimensional lookup table that they email to an address you supply when you initially log in to the online banking service, further access is blocked until you enter a code from the table. New Measures to Make Online Access Safer describes the plan and a short video (FLV) provides further details." For the security conscious among us, do you think this is a decent way to implement the 'something you have' portion of a well secured system, or are there better ways to do it?
Their plan can best be compared to single use scratch off cards. However, I am unsure of what constitutes "something you have" in this example. If someone has the capacity to log into your online banking account, it would seem an email account would be equally subject to access. It would therefore be possible for the authorized owner and the attacker to both possess the table simultaneously. Does this system provide multi-factor authentication or is it simply a convoluted mechanism for sharing yet another secret?
Off topic questions:
Is depending on near instantaneous access to email a reasonable thing to do?
If you were dealing with this situation, would you implement a Firefox extension or a cell phone application to reduce the level of effort for banking access?"
Their plan can best be compared to single use scratch off cards. However, I am unsure of what constitutes "something you have" in this example. If someone has the capacity to log into your online banking account, it would seem an email account would be equally subject to access. It would therefore be possible for the authorized owner and the attacker to both possess the table simultaneously. Does this system provide multi-factor authentication or is it simply a convoluted mechanism for sharing yet another secret?
Off topic questions:
Is depending on near instantaneous access to email a reasonable thing to do?
If you were dealing with this situation, would you implement a Firefox extension or a cell phone application to reduce the level of effort for banking access?"
Require an X509 client side certificates. That should make access to the account practically impossible unless an attacker can get access to the certificate.
The only way to access the certificate would be to compromise the client machine, and if that happens your probably fucked regardless, right?
From the horse mouth:
h ting_fraudu.html
http://www.schneier.com/blog/archives/2006/11/fig
My CU implemented a system whereby I now have two passwords. I guess they are probably following the law, but I'm not safer from anything now, especially since they put some text by the second password telling me what it is about. One of the better comments from the Schneier post points out that two factor authentication isn't worth much if they both use the same channel. Another goes ahead and calls it multiple single factor.
One of the better solutions is to require a phone call(ooh, another channel) for 'high risk' transactions. There are problems with that, but at least it adds some security. Fobs and scratch cards are decent too, but they are susceptible to man in the middle attacks(or whatever you want to call them, they just make phisher more sophisticated).
Nerd rage is the funniest rage.
There's a big difference between having your box taken over and used to spam the world, and having your box taken over and your 5-figure bank-account drained.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
When I call my bank, they never ask me for say, my full telephone pin. They ask for 2 random digits.
So this gives you passwords within passwords. You can have a fifteen digit number/password, and they ask you for random characters from those. Always try to ask for a different combination, and perhaps ask in more ingenious ways, like the third letter and the fourth from last (which could be the same position as the third - if you had a stupid password).
You can then keep the password long enough for it to not be too much of a bother to remember. And they can always disable the account if too many wrong tries are made.
The cleverest thing to do though, is to probably make it harder to do international transfers of cash using accounts, or impossible online. And make it harder to have an account without giving some form of verifiable ID. My bank does that. It is quite silly to steal money online into another local account in my estimation anyway, because you will be caught. Internationally is another issue, because some countries may not cooperate.
Anyway, how many people do you know who have had their money stolen from their bank accoount online. I guess very few.
For those who missed it, the above post is enclosed in [sarcasm] tags
I could never figure out how anyone could believe that "name of favorite pet" or "last 4 digits of your phone number" or "name of your [insert whatever here]" is a good security question.
Now, to answer the REAL question posed by the article's title:
- the answer is obvious - go to an anonymous clinic in another part of town, use a fake name, and pay the doctor in unmarked bills :-)
>If they want to do better than that, they'll have to use biometrics
You can improve on passwords without breaking a sweat. What they've done is switch from a brittle login protocol to one that is closer to the random challenge/signed response that you'd want if there were a computer instead of a human on the other end.
Not only does it block offline phishing, notice that it's even safe from a keylogger.
Still vulnerable at several points to several attacks but a real improvement nonetheless.
Paypal is offering it or will be soon: http://news.com.com/2100-7355_3-6149722.html
Gorkman
One of my local Wells Fargo branches asked for my thumbprint in order to get my balance, after depositing my check. This was despite showing them my ID. They didn't want to see that. When I asked why, and refused to provide a print, I was told to go talk to the manager.
She explained it was a policy to speed up identification, etc.
The customer service agent didn't implement the policy, she doesn't know why she has to collect the thumb print any more than you do. You assumed the thumb print was to provide confirmation of your identity in order to *authorize* the transaction. This is not the case, and also why they don't really care that they've never collected a thumb print before. The purpose of the thumb print is to provide *evidence* after the fact in case there is a fraudulent transaction.
Suppose you are head of Wells Fargo's security department. The CEO has mandated that you implement "greater security" and the CFO demands that you do so on a minimal budget. Which of the following do you choose?
1) Implement a new program requiring millions of customers to come into a physical banking location and establish their authorized thumb print, regardless of their account age, banking history, account balance, or fraud risk. Maintain a secure, reliable, online database of all these thumb prints. Make the database accessible to several thousand banking locations. Implement a near-100% accurate thumb print recognition algorithm. Ensure that all the components in this system can operate at near-instantaneous speed so transactions can be authorized in a timely manner.
Cost to bank: several hundred million dollars
Cost to users: hassle for thumb print at each transaction
2) Implement a new program that requires thumb prints to be taken for each transaction. Thumb prints may be collected on paper, stored at the local banking location, archived only occasionally, and are only ever referenced if a transaction has been flagged as fraudulent. If such a thing does happen, surveillance tapes and the thumb print may be supplied to law enforcement for further action.
Cost to bank: in the tens of millions of dollars
Cost to users: hassle for thumb print at each transaction
Both methods produce essentially the same amount of security, particularly for dumb criminals who may not know that the bank is relying on method 2 and not method 1. I honestly can't say I would have chosen differently either.