Posted by:
admin
17 years, 1 month ago
ETrade announced that they would be offering RSA SecurID key fob tokens to account holders with more than $50,000 in assets. In general, I look at this a good news for the industry. As RSA will tell you, only about 15% of all remote and mobile workers use two-factor authentication. If they number is correct and it grows on a normal curve, look out! It will be a big rising tide and should lift the WiKID boat as well. So anything that promotes two factor authentication in general is good. It is after all an absolutely huge market. And it is far, far more secure than using passwords. (I guess it is too expensive, though, for all ETrade customers ;).
However, I want to point out something that Adam Shostack pointed out to me: using two-factor alone doesn't stop phishing! . It would be trivial for a phisher to login to ETrade automatically within the 60 second passcode lifetime of SecurID. In fact, users might be lulled into a false sense of security by the use of the tokens and be more likely to succumb to a phishing scam.
At this point in time, WiKID is no better. However, we have thought about making our PC token launch the default browser to the correct SSL-certified page (perhaps even to the correct IP Address to avoid a poisoned DNS cache?). By making it easier for the user, they are less likely to go to a fake page. Thoughts?
Share on Twitter Share on Facebook