Take the 2-minute tour ×
Personal Finance & Money Stack Exchange is a question and answer site for people who want to be financially literate. It's 100% free, no registration required.

I have one of these secure key things, that I have to use to log into my bank account. It is extremely annoying, and makes mobile banking awkward. So I want to know if it's worth it.

The key, once I've put in a PIN, generates a number, which the bank website (somehow, magically) knows already and accepts.

It is wallet sized and designed to go in your wallet, along side your card and the slip of plastic paper I was given that has my user name for online banking is also designed to go in wallet.

If I lose my wallet/it gets stolen and if the user knows my PIN (he'd still need to know the PIN if I didn't have a secure key card) surely he can then access the money in the account through an ATM and online?

Whereas without the secure key card system, I have to remember a number and then enter certain digits of it to log in. As this is in my brain no one can steal it physically.

What makes this new token-based system more secure?

share|improve this question
add comment

3 Answers 3

Yes, it is substantially more secure than a simple pin or password. This is because, in addition to knowledge of the pin (and account name or number), it requires the possession of the "secure key" device in order to gain access.

In a system without such a device, all that is needed for access is knowledge (e.g. of the username and pin). This knowledge can be acquired by crooks in quite a few different ways, many of them automated and not requiring the contents of your wallet. For instance, a computer you use in a hotel could have a "key logger" that records what you type in when you use the computer to access your bank account. There have been a number of cases where debit card pins and numbers have been copied from just normal use of a (compromised) retail card-swipe terminal or an ATM. There are many other nefarious method, such as the "man in the middle attack".

With a system like you describe, such attempts by the crooks fail because they do not have access to the "secure key" device and so cannot come up with the ever-changing secret numbers generated by the device.

share|improve this answer
    
So this is to combat the "remote" criminal, i.e. the one that never sees you or comes into contact with you? –  Jonathan. Oct 15 '11 at 22:14
1  
@Jonathan it is what is known as Multi-Factor Auntentication –  user4127 Oct 17 '11 at 17:02
add comment

The whole point of two factor authentication over single factor for online banking is as follows:

Single factor (username and password)

An attacker requires very little effort to get these from you (this could be via a trojan, a man in the middle attack, a keylogger etc) and once they have them they can log in or make transactions from your account. They can do this days later, or repeatedly.

Two factor (username, password, token)

When you type your pin onto the token, the number generated is known only to you and the computer at the bank, and it is only valid for a short time (usually 30 seconds) An attacker who has the same access as before and has grabbed that number sent back to the bank now would have to perform his attack in that 30 second window .

What some banks do is add another factor - as well as the PIN you type into the device, the website gives another number which you type into the device - and when it diplays a new number you type that back into the website. This removes not only the 30 second window for the attacker, but also removes the ability of an attacker to change the recipient of the payment.

tl;dr - yes, it's annoying, but it will help stop you being robbed

share|improve this answer
add comment

You can read about this technology on Wikipedia here. There are many variations on this same concept.

The short answer to your question is: Yes, it is more secure.

The longer answer, as you suggest, is that security depends on using the technology properly. Mishandling your key card, along with a weak PIN, could lead to lower security.

The main advantage of the two-factor auth is not that it prevents someone from stealing your PIN from your brain, but that it makes guessing your PIN (or watching you enter it) worthless.

share|improve this answer
    
but if someone watches me enter the PIN on the key, they get onto the online banking, and not only access my money in my card's account, but also the money in my savings. –  Jonathan. Oct 15 '11 at 20:12
1  
@Jonathan: That's why I said security (as always) depends on using the technology properly. Many studies have been done about the actual security of greater security measures. One that pops to mind is that requiring users to change passwords every 30 days, for instance, can lead to worse security, because users often start using weaker, easier-to-remember passwords as a result of such policy. Is it possible to use a secure key insecurely? Yes. However, if used properly, it is much more secure. –  Flimzy Oct 15 '11 at 23:48
    
@jonathan - That number on your dongle should change every ~3 minutes so unless the attacker uses the number before it changes then even having your pin and an atm card emulator will prevent him from getting into your account. –  user4127 Oct 17 '11 at 17:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.