Hacker News new | past | comments | ask | show | jobs | submit login

Agreed. Except a lot of companies have a lot of " financial incentives at stake to be diligent security wise" but aren't.

Something I very recently heard: "World of Warcraft has had RSA-style two-factor token authentication for years, and my bank still doesn't"




Some thoughts re WoW vs banks:

WoW Authenticator is optional, costs $30~40, and intended for serious WoW players in a community with very strong peer support. Banks can do first two but don't have a community of tech savvy users to reduce cost of support manageable.

So Blizzard could but banks couldn't. Will this change? I think so but it'll have to be opt-in and paid for by customers, likely through third-party services first.


$6.50, not 30-40: http://us.blizzard.com/store/search.xml?q=authenticator - this omits the free apps for most smartphones.

As far as peer support, honestly, there's almost no peer support. There is a strong first-line of FAQs and automated systems (regularly ensuring secondary contact information is accurate, well-defined systems for lost authentication devices,etc) and well-trained second-tier tech support.

There are enough third-party auth providers now that would be well able to provide the entire support chain for the banks. In fact, Gemalto has built for this: http://www.gemalto.com/financial/ebanking/


Every bank in Germany (that I know of) uses TAN lists. They mail you a list of generated numbers, and for each transaction, you need to enter one of those numbers, which is then consumed.

No fancy gadgetry required. Just a sheet of paper gives you all the same security advantages.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: