7

I have one of these secure key things, that I have to use to log into my bank account. It is extremely annoying, and makes mobile banking awkward. So I want to know if it's worth it.

The key, once I've put in a PIN, generates a number, which the bank website (somehow, magically) knows already and accepts.

It is wallet sized and designed to go in your wallet, along side your card and the slip of plastic paper I was given that has my user name for online banking is also designed to go in wallet.

If I lose my wallet/it gets stolen and if the user knows my PIN (he'd still need to know the PIN if I didn't have a secure key card) surely he can then access the money in the account through an ATM and online?

Whereas without the secure key card system, I have to remember a number and then enter certain digits of it to log in. As this is in my brain no one can steal it physically.

What makes this new token-based system more secure?

Improve this question

3 Answers 3

Reset to default
10

Yes, it is substantially more secure than a simple pin or password. This is because, in addition to knowledge of the pin (and account name or number), it requires the possession of the "secure key" device in order to gain access.

In a system without such a device, all that is needed for access is knowledge (e.g. of the username and pin). This knowledge can be acquired by crooks in quite a few different ways, many of them automated and not requiring the contents of your wallet. For instance, a computer you use in a hotel could have a "key logger" that records what you type in when you use the computer to access your bank account. There have been a number of cases where debit card pins and numbers have been copied from just normal use of a (compromised) retail card-swipe terminal or an ATM. There are many other nefarious method, such as the "man in the middle attack".

With a system like you describe, such attempts by the crooks fail because they do not have access to the "secure key" device and so cannot come up with the ever-changing secret numbers generated by the device.

Improve this answer
2
  • So this is to combat the "remote" criminal, i.e. the one that never sees you or comes into contact with you?
    – Jonathan.
    Oct 15, 2011 at 22:14
  • 1
    @Jonathan it is what is known as Multi-Factor Auntentication
    – user4127
    Oct 17, 2011 at 17:02
6

The whole point of two factor authentication over single factor for online banking is as follows:

Single factor (username and password)

An attacker requires very little effort to get these from you (this could be via a trojan, a man in the middle attack, a keylogger etc) and once they have them they can log in or make transactions from your account. They can do this days later, or repeatedly.

Two factor (username, password, token)

When you type your pin onto the token, the number generated is known only to you and the computer at the bank, and it is only valid for a short time (usually 30 seconds) An attacker who has the same access as before and has grabbed that number sent back to the bank now would have to perform his attack in that 30 second window .

What some banks do is add another factor - as well as the PIN you type into the device, the website gives another number which you type into the device - and when it diplays a new number you type that back into the website. This removes not only the 30 second window for the attacker, but also removes the ability of an attacker to change the recipient of the payment.

tl;dr - yes, it's annoying, but it will help stop you being robbed

Improve this answer
3
  • Once a number from the token is used, it cannot (or absolutely should not) be usable again. With all the systems I am familiar with, there is no 30-second (or 60-second) window for an attacker to reuse the number. It's possible that some old schemes allowed reuse of the code, but no self-respecting modern 2-factor authentication system would allow code reuse.
    – ErikE
    Aug 4, 2015 at 17:42
  • 1
    Code reuse isn't the issue. It's the attacker using it before you do!
    – Rory Alsop
    Aug 4, 2015 at 21:42
  • I agree that the big problem is an attacker using it before you do. If the attacker can grab the code in transmission and stop it from being used by you, he can use it himself. A man-in-the-middle attack could accomplish this. But in any case, your post doesn't make clear that this 30-second window you mention depends on blocking the user's initial submission. If the user's submission works, the attacker's copy is useless.
    – ErikE
    Aug 4, 2015 at 21:52
3

You can read about this technology on Wikipedia here. There are many variations on this same concept.

The short answer to your question is: Yes, it is more secure.

The longer answer, as you suggest, is that security depends on using the technology properly. Mishandling your key card, along with a weak PIN, could lead to lower security.

The main advantage of the two-factor auth is not that it prevents someone from stealing your PIN from your brain, but that it makes guessing your PIN (or watching you enter it) worthless.

Improve this answer
3
  • but if someone watches me enter the PIN on the key, they get onto the online banking, and not only access my money in my card's account, but also the money in my savings.
    – Jonathan.
    Oct 15, 2011 at 20:12
  • 1
    @Jonathan: That's why I said security (as always) depends on using the technology properly. Many studies have been done about the actual security of greater security measures. One that pops to mind is that requiring users to change passwords every 30 days, for instance, can lead to worse security, because users often start using weaker, easier-to-remember passwords as a result of such policy. Is it possible to use a secure key insecurely? Yes. However, if used properly, it is much more secure.
    – Flimzy
    Oct 15, 2011 at 23:48
  • @jonathan - That number on your dongle should change every ~3 minutes so unless the attacker uses the number before it changes then even having your pin and an atm card emulator will prevent him from getting into your account.
    – user4127
    Oct 17, 2011 at 17:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .