Hacker News Reader

Comment by corin_ | Hacker News Reader

I can't speak for all banks, but I'm with Barclays in the UK, and their system makes keyloggers a non-issue in a similar way. I can login to "basic online banking" using a few things from memory (surname, online ID number, debit card number, date of birth and password all required), but to actually do anything (like send money to another account) I need to authenticate using a chip+pin machine that they sent me free of charge. I insert my debit card, enter my PIN, then it gives me an 8 digit number that's time-sensitive. Frankly, this annoys me, why can't the reader connect via USB to save me typing in that number?

And I know at least one American bank has the same thing (possibly Bank of America?), as a friend of mine was the guy who pretty much created all of it.

View on HN

At least two banks here in Greece use a similar system (it's essentially a two factor authentication variant).

Connecting it via USB would defeat the whole purpose of this second trusted information channel, between the OTP device and the bank's customer.

I think they all do, nowadays. The only reason I don't need a keyfob for my Alpha account is that when I opened it, 9 years ago, they didn't have keyfobs. Their password policy was retarded, though, it wouldn't accept a $ in the password. Of course, you can't do anything without the keyfob now other than view the balance and pay some bills, so it's okay.

I'm pretty sure Alpha still doesn't permit non-alphanumeric characters in passwords.

Go figure..

How people get paid to design systems like that, I'll never know.

The reader connecting (and transmitting) via USB would sort of defeat the secondary-device security point, wouldn't it?

Possibly but... would still be a lot more complex than just having a password. For example a standard keylogger wouldn't pick it up.

That's security through obscurity. All existing techniques have been attacked (eg. keyloggers now take screenshots to defeat the silly pull-down menu "security"), so it's only a matter of time before they start capturing USB output and using it to attack the account in real time.

What's wrong with a key fob displaying numbers with no physical connection to the computer?

Edit: The first UK retail bank to offer this as standard would definitely get my custom. I'm quite serious about that. Also drop "VerifiedByVisa" nonsense at the same time and replace it with similar real security.

NatWest require the secondary factor if you either add a new payee or send a payment for the first time to a particular payee. You can still login and do almost anything else without it, though.

Reply on news.ycombinator.com