Court Rules Passwords+Secret Questions=Secure eBanking

An anonymous reader writes "A closely-watched court battle over how far commercial banks need to go to protect their customers from cyber theft is nearing an end. Experts said the decision recommended by a magistrate last week — if adopted by a US district court in Maine — will make it more difficult for other victim businesses to challenge the effectiveness of security measures employed by their banks. This case would be the first to add legal precedent to banking industry guidelines about what constitutes 'reasonable' security. The tentative decision is that a series of passwords + some device fingerprinting is enough to meet the definition of 'something you know' + 'something you have.' The case has generated enormous discussion over whether the industry's 'recommended' practices are anywhere near relevant to today's attacks, in which crooks usually have complete control over the victim's PC."

Comments

One-time pads

[Anonymous Coward]

We've been using one-time pads in Finland for a long time, and they do the job.

What's the issue?

Re:One-time pads

[Anonymous Coward]

well. Here in the US we don't feel like spending money on security.

Re:One-time pads

[ekhben]

I think you have it the wrong way around. It's an exceptionally hard problem to have a highly secured end user network. It's an easy problem to have stronger authentication mechanisms.

One time pads are not new, or difficult. Two-channel authentication is not new, or difficult. These are not particularly expensive solutions to implement, and would cut down on fraud significantly.

So why do the banks resist the idea?

Personally, I use a bank with two-channel auth, and refuse to use electronic banking that relies on anything sent via my browser alone - the browser is insecure software, and can be taken over without the victim being aware of it, even when the victim is following good security practices.

Re:One-time pads

[MightyMartian]

Maybe we can let the TSA take over computer security. You can have a couple of brawny perverts in front of every computer reading to cup your genitals before you go to pay some bills. Add in a X-ray machine to toast your testicles, and you're ready to go!

Re:One-time pads

[Snarky McButtface]

I can handle my own genitals when in front of a computer screen.

Re:One-time pads

[pirho13]

As the previous poster said, we don't like spending money on Security.
Now Security Theater, that's entertainment!

This has a name

[IICV]

There's a name for this sort of security - "Wish it was two factor" security.

And now a judge is ruling that it's enough, along with a "device fingerprint" that can be trivially faked? That is complete bullshit.

Re:Secure = Secure Enough

[FatAlb3rt]

Unless the questions are like my bank's:
Who is your favorite Disney character?
What is your favorite color?

You stand a good chance to get the right answer for any given account if you go with Mickey / Minnie or red / blue. How is that really security?

why not use some sort of authenticator?

[snuf23]

I find it odd that Blizzard offers more security for a World of Warcraft account than your average bank.

Calm down

[Charliemopps]

Seriously, everyone calm down. If your banks security sucks, switch. It's really easy. I switched banks on monday... it took me all of about an hour. Imagine if the judge had came down with a verdict like: True security is a 30+ character alpha-numeric password that is at least half capitals or special characters. The same password can never be reused. The user name must be a randomized 10 digit numeric sequence. Both user name and password can not be valid for longer than 30 days at which point both must be mail separately to the user on different dates. Users can not reset passwords without being in-person and present 2 forms of ID at a branch office. Lastly login periods can not last for more that 5min upon which the user must log in again.

What banks really need to do is give you options to lock down your online account. I want online banking, but I only want to transfer money between my accounts with that bank and 1 other account. Why can I not pre-approve those accounts and disable everything else unless I go down to the bank? Seems like a simple concept. Even if I were to get hacked, they could only move money around in my own account!

Re:Calm down

[Rockoon]

If your banks security sucks, switch

Switch to another insecure bank? The problem is that this shitty security is industry standard.

And if you don't mind me asking... What was the name of your first childhood pet?

Re:Secure = Secure Enough

[definate]

I always answer those questions, with a different password. This results in many people going, "LOL So your mothers maiden name is jks)*8h9*H*(BY?"

This is when those are used for verbal authentication over the phone. Then on top of this, I just need some reasonable password management.

All good!

What are banks for?

[taucross]

If banks can't protect our money, and aren't liable when it goes missing, then what are banks for?