Slashdot Mirror
Should Online Banking Use Flash for Verification?
larrystotler asks: "One of my banks has instituted a new 'Secure Sign-in' setup. They allow you to register your computer with them so that you don't have to go through the new extra security steps. This involves the use of cookies -and- Flash Objects: 'Adobe Flash objects store data in much the same way that cookies do on your computer. If you have Flash installed, we can recognize your computer in the event that you erase all your cookies.' This requirement of Flash will probably negate my ability to access my bank account when running Linux on my PowerMac since Flash Player is not available for it(haven't tested it yet). However, the real question is: Is Flash a good, secure option that a bank should use to help identify you?"
No.
Next question?
c++;
The idea itself isn't bad, but the requirement to install a third-party software add-on isn't, especially one which is only available for a few platforms.
Mainframe/UNIX Bit Twiddler and long time Windows/Linux Hobbyist.
The Theorem Theorem: If If, Then Then.
It's simply irresponsible to permanently store security credentials on the client. Also call and ask them how long they spent auditing the source code for flash player before implementing this.
Use SSL Client Certificates.
EOM. (Temojen at work)
...is to use two sets of authentication tokens, like this:
1. Connect via HTTPS
2. Log in. Sites sets tokens (with expiration times) in cookies and Flash data.
3. If cookies and Flash data disagree, assume the connection has been hijacked by another app on the PC and discontinue session.
4. Delete tokens on log-out.
I'm not sure if this would actually accomplish anything, and I'm not exactly thrilled about requiring a third-party plug-in, that it's the only thing I can think of that might actually be useful.
Recently, I've moved from a house that had an electric water heater to a house with a gas water heater. Sadly for me, this means that I'll no longer be able to use my custom-built circuit monitoring hardware (which uses a Linux-based electricity usage tracking app I wrote myself!) to estimate what percentage of my monthly electrical bill was used to generate hot water. However, the real question is: is it really a good idea to pound on the gas main with a ball-peen hammer?
Obliteracy: Words with explosions
If somebody is erasing all their cookies, chances are they don't want you hiding data elsewhere too. What happens when one of your customers wipes their cookies before selling their computer, and the buyer fishes out the sensitive data from the Flash storage instead because you've overridden their wishes?
Bogtha Bogtha Bogtha
If they are using Flash and a feature intended to help make sure they know you are using a computer you previously used it helps. (Like a cookie)
As part of a multi-factor authentication system it can help.
The probably are not using it as the primary authentication (account number, password). (If they are, they'll get shut down quickly.)
If your platform can't handle the Flash, chances are they'll make you go through a longer more customized login procedure, like answer previously arranged "security questions" and so on. It will be slower, but it will work.
There are some pretty aggressive new regulations concerning online banking login methods, so more and more of this stuff will be appearing. They will all still have a primary user/pass combo of some kind though.
From this article:
From the article you point to:
Bogtha Bogtha Bogtha
The real question is: should any bank make it easy to "register your computer with them so that you don't have to go through the new extra security steps". The answer ofcourse is "no". If I break into your house and steal your computer, I now also have access to your bank account (which you probably have a handy bookmark for to make it even easier). Also, anyone you trust into your house (babysitter, etc.) can now get into your bank account.
Banks shouldn't make it easy to remove the "what you know"-part of the authentication. It's there for a reason.
(Then again, I probably misunderstood what "the new extra security steps" are. But there ya go.)
Regardless of the actual security issues, asking "Should Flash be used for(fill in blank here)?" on Slashdot is a question that I think we all know the probable responses to already...
However, the real question is: Is Flash a good, secure option that a bank should use to help identify you?"
This is a foolish, short sighted strategy. Do you really think Flash is going to be the same 5 years from now? Is it even going to exist in 10 years? Does this solution even address the real security concerns, or is it just an ugly hack dreamed up by some people that have no other solution? I'd say the latter.
Banks need to get together and solve this problem outright. It's hurting all of them because they all have to develop these proprietary technologies (that only wind up sucking). They need to get together and find someone they all trust to lead development of a technology to secure transactions. If they were smart they'd hire someone like Bruce Schneier to design and oversee development of a system for them to secure web transactions.
IMO this techology lies under the "something you have" category of authentication, unlocked by "something you know". In other words a hardware device of some type that plugs into a USB port, and verifies that:
A. You're talking to the bank you think you are. Thus avoiding phishing attacks that get people to connect to sites pretending to be the bank.
B. That you are who you say you are.
Design it in such a way that if one component fails, the whole thing isn't compromised. I'm not a crypto/security expert, but from what I know all these requirements aren't even very technically challenging.
AccountKiller
Flash is ok to add eye candy and a sound track.
However, all web sites should be usable by someone who doesn't use flash at all.
Just to sprinkle some numbers into the discussion...
p layer/version_penetration.html
http://www.adobe.com/products/player_census/flash
Flash drive? Yeah sure, I might consider accepting a dongle of sorts and popping it into the USB port when I want to access my account info. Of course, you still need the password and pin and all the other fun stuff, if just the dongle itself could access my account I'd smash it with a hammer.
Flash software? Were my credit union (what's a bank?) to require this, I would close my account in a...well, you know.
Not commenting on whether this is a good idea, but the article states that there is no Flash player for linux. Actually, Adobe just released a Linux version on Flash Player 9 a few days ago. And even before that you could install version 7. So you can remove crippling Linux users as a reason to bash this.
Actually, Flash has the potential to revolutionize online security. With the increasing numbers of webcams, users could opt to require a "video signature" to log on, in addition to regular password credentials. The video signature could quickly be checked by a company like Brinks to see if the remote user is the correct user, and grant access to the user accordingly once the correct password has been provided.
The Political Programmer
Not necessarily. It sounds like, if you use the plugin, the bank won't ask you those stupid "security questions" at login time, since they will be able to "recognize the computer."
Ideas for security questions:It goes beyond 'neo-luddites'. We have open standards for a reason--and that reason is so that if I want to create a platform and communicate with the existing infrastructure, I have everything that I need to make an application on that platform that will work with everyone else. The HTML specification is an excellent example of this. People have made HTML rendering engines for almost every device that has an IP address, and for many that don't, as well (my old Palm IIIxe had an offline webpage reader).
When you throw closed standards into the mix, you start make things harder. If my platform of choice doesn't have an HTMl renderer, I can write one. If my platform of choice doesn't have a Flash player, I can't. I either do without Flash, or I switch platforms.
Of course, some people can't switch platforms. My Windows Mobile 5.0 phone doesn't work with Flash--at least, the default browser doesn't. If I use NetFront, I can get Flash 7. Will this banking website work with that, or will Flash 9 be required?
My only problem with this is that the standard isn't open. If it's an open standard, even one for which my platform of choice has no current support, I'm ok with it. If it's a closed standard, the answer is 'no'.
You must be mistaken. The correct answer is "Hell, no! " or "Fuck, no!" or "No, and you should be executed for having suggested it!"
Hope that clears things up. : )
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
1. They use the Cookies and/or Flash to negate the requirement of answering "up to" 3 extra security questions. They still require you to use your password regardless of anything else.(of course, if you password is on a post-it note on your monitor and your computer gets stolen.....kinda makes it easier, especially in the case of a laptop).
2. I haven't fired up my PowerMac 9600 to see if I can even log into my account, but I doubt it since I have to click on the flashbloker icon to even be able to get to the logon on my Dell.
3. I have Firefox set to clear private data when it is closed. The Flash part is supposed to "help" verify my computer if the cookies aren't present. This would ONLY apply if I actually "register" my computer with the bank, which I don't forsee myself doing since I have a computer in about every room except the bathroom.
4. Does Flash store information about my browsing history on my system that would allow such a verification? If so, then it sounds like it needs to be removed from my system in my interest of a secure experience.
5. Reminds me of how a large sat TV company requires it's dealers to use IE6/ActiveX to input Credit Card info and Social Security numbers to create an account because it was the "Most secure" way to do it.....
I guess we are cool giving a big "FU!" to anyone who is disabled (blind) and using a specialized browser. After all 99% of the population can see just fine. For that matter lets get rid of all those damn wheelchair ramps cluttering up the place.
Finkployd