Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Short answer from my experience is cost. The individual tokens have a cost, then there's the management overheads of running the system. Initially it doesn't seem like too much but if you've got a customer base numbering in the millions, it can get quite pricey.

Obviously if the cost (to the bank) of online fraud gets high enough it starts to make more sense. What's interesting is that some online apps (eg, World of Warcraft) have seen the benefits of providing 2-factor authentication faster than a lot of Financial Services companies.

2-factor auth of one kind or another seems to me to be a good idea for online banking, given the prevalence of banking trojans which have keylogging functionality.



With smartphones becoming increasingly prevalent, there's no reason a software OPT on your phone couldn't be used by many people.

Those without smartphones could fall back to fobs or more "traditional" forms of auth.

Question: what is a good/trusted one-time key generator for Android and/or iPhone?


Google offers one. http://code.google.com/p/google-authenticator/

It implements an open standard for OTP and they provide source for a PAM module to require the OTP on the computer side.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: