Now that its here, this document is less than clear about two factor authentication. ffiec_frequently-asked-questions.pdf Finextra: analysis – Online banking security FAQs The Federal Financial Institutions Examination Council (FFIEC) has released a frequently asked questions document (FAQs) to aid in the implementation of the interagency guidance on Authentication in an Internet Banking Environment issued October 12, 2005The authentication guidance, which applies to both retail and commercial customers, specifically addresses the need for risk-based assessment, customer awareness, and security measures to reliably authenticate customers remotely accessing their financial institutions’ Internet-based financial services. The FAQs are designed to assist financial institutions and … Continue reading FFIEC releases its FAQ finally, but still unclear

A well crafted and reasoned view on the ‘man in the middle attack’ on Citibank tokens, from Improving.  This provides good balance to my earlier post. Improving New Account Opening: Citibank Hardware Tokens Defeated – but don’t blame the tokens – Solving complex business problems with financial services technology Physical tokens are not dead. But as the Citibank example has shown, without providing additional layers of protection to users to help them avoid phishing, a well crafted, realtime scam can defeat even this two factor authentication. Continue reading Citibank Hardware Tokens Defeated – but don’t blame the tokens

In a rather timely fashion, after yesterdays story on Barclays card readers for security, here are clearer details on the Citibank ‘man in the middle’ attack, that defeated hardware tokens. Citibank Hardware Tokens Defeated: The Beginning of the End – AllPayNews: Payment and fraud news, blog, jobs and discussions A long-predicted vulnerability of hardware-token based multi-factor authentication has now been successfully exploited against Citibank, marking the beginning of the end for the small security devices.….. In a textbook example of a “man-in-the-middle” attack, Citibank business customers were lured to dozens of counterfeit websites located in Russia where they were prompted … Continue reading Citibank Hardware Tokens Defeated: The Beginning of the End

A rather unusually sepcific ciriticism of HSBC’s online banking system.  Researchers claim that criminals can get in within 5 – 9 attempts.  Most systems refuse you after 3 +/- attempts, so if true, this is a significant problem, but probably manageable by implementing some restrictions.  Lets see how HSBC react. Finextra: Researchers warn of HSBC Web banking security flaw Researchers at Cardiff University have uncovered a flaw in HSBC’s online banking system that has left the accounts of 3.1 million UK customers exposed to hackers for at least two years. According to a report by UK newspaper The Guardian the … Continue reading Researchers at Cardiff University have uncovered a flaw in HSBC’s online banking system