Security threats Toolkit

Story: Two-factor authentication 'not the solution' to online fraud

• 
• 

Robert,

I saw your article on the CNET site on 16th March 2005 and then went back to read Bruce's original article on Cryptogram. It's all good stuff, however...

The reality is two factor authentication IS a solution to identity theft – just not a sole solution. If I can use a house as an analogy – putting a lock on the front and back door doesn’t secure the whole house. You need to look at window locks, an alarm system etc.
Two factor authentication is an essential part of the overall defence against phishing. It's critical to move away from static passwords to something stronger and two factor authentication is just part of the arms race to secure all our defences!

Used in a traditional way, e.g. to authenticate a web session, two factor authentication can be compromised , however if you use two factor authentication across TWO independent communications channels (i.e. Web plus Phone or SMS) then you really can defeat these sophisticated attacks, and it's not as complex to use as it sounds. In real life it would work like this:

The user logs in to their on-line bank account via the web channel with a one time passcode (OTP), to complete basic functions such as check balances etc. However if s/he wants to do a significant transaction - such as set up a new payee and transferring a large sum, then this transaction must be specifically authorised by the user via the second channel.

The bank would use an automated system to SMS or phone the user on their registered mobile/home phone to inform them of the transaction and ask for confirmation. To confirm the transaction the user would enter a new OTP via the phone keypad. S/He is also given a choice to be connected to a security helpdesk if they are NOT aware of the transaction and want to raise an alert.

So in this situation the SAME OTP-based 2 factor authentication system is being used, but in a more flexible way to authenticate the user via more than one channel.

The key is that banks and businesses must buy into 2 factor auth systems that CAN be used over multiple channels. OTP based systems work in this way, but biometrics and PKI smartcards and USB devices cannot be easily used over both web and phone.

So, banks & businesses who are investing in the right form of 2 factor auth with the flexibility to work over multiple channels are NOT wasting their money. Others who are investing in 2 factor auth that can only work over the web are going down a blind alley.

I hope this is a useful summary. We at Signify spend our (sad) lives purely designing different authentication systems to suit different market places, so we are aware that there's no silver bullet to solve all problems. But there are solutions if you look for them. :-)

If you want to chat it over - please do feel free to call or e-mail.

Best regards

John Stewart

• 
• 

• 
• 
• 

Full Talkback thread