[PLUG-TALK] Challenge Question Authentication Holy S***!

[Paul Heinlein]

On Mon, 4 Apr 2016, Rich Shepard wrote:

> On Sun, 3 Apr 2016, Keith Lofstrom wrote:
>
>> The problem is, most websites use the same short list of security 
>> questions, like "what was the name of your first pet?" and "what 
>> was the name of your elementary school?"
>
>   Financial institutions in particular should all authenticate by 
> sending a one-time 6-digit number to the user's telephone. That 
> number is then provided in a text entry widget on the web page 
> before access is allowed. That makes more sense than questions, 
> unless the user is allowed to make up the question and provide the 
> answer when opening the on-line account.

That's Vanguard's solution, and I feel pretty confident in it. The 
risk of someone surreptitiously snooping my password AND stealing my 
mobile phone is very low.

The thief would also need to ensure I didn't read my e-mail for a 
business day or two, since Vanguard also sends transaction notices 
to my e-mail account -- which in normal circumstances means I'd see 
(and presumably be able to cancel via a voice call) the suspicious 
activity.

Of course, I don't use Vanguard for day-to-day banking either. 
Transaction security for checking-account activity is harder, but web 
logins should at least offer a phone-based second authentication 
factor.

-- 
Paul Heinlein <> heinlein at madboa.com <> http://www.madboa.com/