Skip to main content

etrade-to-deploy-rsa-tokens-but-does-it-stop

Posted by: admin 15 years, 12 months ago
ETrade announced that they would be offering RSA SecurID key fob tokens to account holders with more than $50,000 in assets.

In general, I look at this a good news for the industry. As RSA will tell you, only about 15% of all remote and mobile workers use two-factor authentication. If they number is correct and it grows on a normal curve, look out! It will be a big rising tide and should lift the WiKID boat as well. So anything that promotes two factor authentication in general is good. It is after all an absolutely huge market. And it is far, far more secure than using passwords. (I guess it is too expensive, though, for all ETrade customers ;).

However, I want to point out something that Adam Shostack pointed out to me: using two-factor alone doesn't stop phishing! . It would be trivial for a phisher to login to ETrade automatically within the 60 second passcode lifetime of SecurID. In fact, users might be lulled into a false sense of security by the use of the tokens and be more likely to succumb to a phishing scam.

At this point in time, WiKID is no better. However, we have thought about making our PC token launch the default browser to the correct SSL-certified page (perhaps even to the correct IP Address to avoid a poisoned DNS cache?). By making it easier for the user, they are less likely to go to a fake page. Thoughts?
Current rating: 1

Recent Posts

Archive

2024
2022
2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom