see: http://www.out-law.com/page-7967

The technical staff of banks know this, and they also know that it will cost a bomb to totally implement, and not even work, don’t forget, the thieves are ALWAYS one step ahead

http://news.cnet.com/8301-13506_3-10403425-17.html?part=rss&subj=news&tag=2547-1_3-0-20

Until biometrics and RFID implants have matured, this is probably the most effective protection against illegal access.

Not cheap though!

And yes, it requires a user PIN and the code from the token to gain access; the user still then has to login to the domain. You can get SSO options but in my book that weakens security so why bother?

Option 1: Mobile Phone Synchronized Encryption App
An App could be written for various phones (iPhone, Pre, Android,
ect … ) that work on the same concept of an encryption key. The user
could generate his own custom key, and enter it into his phone via SD
card, SMS, or EMail. This key would be unique to his account allowing
only him to log in. The code would change every few minutes and use
the cell network clock as the source. This would work just like the RSA Key Fob.

Option 2: Randomly Generated Code sent via SMS
A new code could be randomly generated and
sent to the user’s phone via SMS. The code would include upper and
lower case letters, numbers, and special characters, just like any
good password should. Each code would only be valid for a few minutes
and logging on before the server had received the request for
the code would be prohibited.

of course it could be hacked,
Just like any other security method.
But it does stack the odds to be more in your favor.

These things like a few of you had said have been around for so many years. AOL Oppsec employees used to have them to log into their internal accounts.

When you’d log into one of the employee’s internal’s accounts you couldn’t sign on without the current key. The way around that was to use a very out of date AOL version, hehe.

I used to administer a secureID server I believe I bought it in 1995. Ran on a solaris sparc 10.

I was running version 3.52 of the code, not exactly new.

They allow all sorts of devices, software and operating systems to authenticate using radius or tacacs to a centralized server, the user has a 4-8 digit pin and enters a usrename and the pin+the code on the fob.

The server keeps track of the fob, and knows what the code on it should be at any particular time. Each successful login resets the clock sync, if you don’t login for a while (or the server has a lot of clock drift) you need to get in touch with the admin to sync the pin manually. If you are a doofus and reset the system clock to 1985 to try to avoid Y2K bugs then all 5000 people on the server have to call in and resync, as my replacement discovered.

A successful login makes the user unavailable until the code changes. A code entered wice puts the token into next token mode, which can be annoying. I think you can enter your pin in reverse to get an under duress login, if someone has a gun to your head trying to get into your bank account, or sensitive system. The admin gets an email and is supposed to call the cops.

I did this twice, it always involved alcohol.

You would need to do a man in the middle attack to hijack the ssl or IPSEC connection, and then enter the code into the remote system before the user and send user a bad result somehow. This is all encrypted so, good luck super cracker.

Those have been around forever, even world of warcraft offers this.

That made me think of a similar authentication factor for ssh, called skey. It’s basically a one time password authentication scheme. When you login, instead of a password, the system offers you a challenge, which you enter in an OTP generator along with your passphrase, which in turns generates a one time password that looks a bit like this:

BEER MOAT FUEL WHALE JOHN FIVE APPLE

Once you authenticate with that password it’s null and void. And since the OTP algorithm is pretty simple (it uses SHA1 in the latest revisions) you can easily get an OTP generator for your phone (j2me, iphone, etc). This way you never enter anything sensitive into the computer you are logging into, which thwarts keyloggers. Perfect for internet cafés and untrustworthy places.

Case in point: I have to log in to a VPN, then I have to RDP to a server. The VPN connection requires a one-time pass from my SecurID fob, and maybe 10 seconds later I can get the RDP prompt, which also asks for my OTP from SecurID. I always have to wait for the number to change before it will let me in. The central authentication server won’t let you use the same number twice between changes.