Skip to main content

Two-factor authentication for banking

Posted by: root 7 years, 7 months ago

Clearly, you should not use SMS for banking authentiation.  We have been saying this for over eight years now.   The solution must use encryption that you control.

Any hardware-based solution like key fobs would be very expensive and difficult to scale.  Banks have a lot of users.

Obviously, any shared-secret based solution may be vulnerable an attack similar to the Chinese attack on RSA, which then required re-issuing all tokens - an expensive proposition if you have a lot of users even if you are using software tokens.  Private/Public keys that are generated on the users' devices are much better. 

Since network-based Man-in-the-middle attacks are so easy to do now and since certificates are impossible for even advanced users to verify, you should have some form of mutual authentication.

You need a solid API so you can manage enrolloment and create CSR management tools.

You need to be able to white-label the two-factor authentication client into your sofware and you need the server to be highly-scalable.

The WiKID Strong Authentication System meets all these requirements.

Current rating: 3

Recent Posts

Archive

2024
2022
2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom