5

I work in the computer industry, and I know a few things about security, like the fact that those "security questions" that you're asked for are pretty much completely bogus and not useful as security. (Besides, I tend to forget little things whether or not I uppercased the P in 'Fluffy the Piranha' for the question about your first pet.)

I'm really somewhat concerned about the state of security of at least one online banking platform. (Me and Bruce Scheiner both, I suppose.) So I'm looking for resources to learn which banks which offer real two-factor authentication (like the little RSA keyfobs, or at least text messages to your phone) to confirm logins, and what other security features they can provide.... real security features, not just security theatre.

Improve this question
4
  • Great question! Something like that would be a good resource to look up before opening an account somewhere. Too many service reviews focus on costs or other features/freebies.
    – Chris W. Rea
    Feb 25, 2010 at 22:54
  • Can you explain why the security questions are not useful? Also, is the US different from the UK in terms of fraud liability? If you are a victim of fraud in the UK (and of course you're able to prove it, within reason) the bank is liable, not you.
    – James
    Sep 24, 2014 at 14:45
  • 2
    @b3njamin: In multifactor authentication theory, there are three factors: something you know (password/PIN), something you have (hardware token, smart card, etc) or something you are (biometrics). A "security question" is another "something you know" and does not add to security. In practice, many security questions must be selected from a common list which requests facts like "mother's maiden name" or "what year did you graduate high school", facts which may be ever so modestly obscure but are definitely not secrets. See also: en.wikipedia.org/wiki/Multi-factor_authentication
    – user296
    Sep 25, 2014 at 13:22
  • @fennec Thanks for the explanation - I must admit to never actually 'answering' those questions (doesn't matter in the slightest whether it's a dropdown or not) so to me they're simply additional random passwords, making them impossible to uncover with identity theft.
    – James
    Sep 25, 2014 at 14:45

3 Answers 3

Reset to default
3

A problem with your question seems to be that you expect a site which details whether a particular bank uses 2 factor authentication to help you decide the relative security. In testing thousands of applications for various global banks I can tell you that what is far more important is information you are unlikely to find out: has the 2 factor authentication been correctly implemented?

You could also try to guess using the published figures on number or extent of compromises, but as different banks are targeted differently this won't help you too much either.

You'd hope that knowing your bank passes PCI DSS regulations it would be secure, but as proven by the Worldpay debacle (where over $9M was stolen even though they had passed PCI DSS) this isn't enough either.

Improve this answer
2

Here is a site that sort of does it. Hopefully you find it useful.

http://www.consumersearch.com/online-banking/compare

Improve this answer
0

https://twofactorauth.org

A nice list of all sorts of services and their multi-factor auth status, the site also enables you to bug a bank or service via Twitter to implement 2FA.

Improve this answer

You must log in to answer this question.