SMS, Trojans and Two-factor authentication

Posted by:

admin 10 years, 10 months ago

I've often said that SMS is a weak basis for two-factor authentication.  It is unencrypted and unreliable. It is too easy to take over someone's account.  I was reminded of it today by this puff piece on American Banker - an ad for RSA's anti-trojan services.  Obviously, RSA sells anti-trojan services and two-factor authentication.  We sell two-factor authentication as well, but not SMS-based.  (We use software tokens that use asymmetric (public/private) keys.)

What struck me about this article is how hard the trojan has to work to get the money.  First, infect the machine.  This can be done in two ways: email or drive-by download. Second, the user needs to download a trojan to their smartphone.  A pop-up from the infected browser tells them they need the software on their phone.  This tact won't work on Apple devices because they don't allow you to download apps  (Yay walled garden?). It only works on Android devices where the user has selected to allow 3rd party apps.  I assume it also doesn't work for non-smart phones and less popular operating systems (Blackberry? Zing!).

So, by adding SMS validation, the banks have protected a significant portion of their user base.  Unfortunately, the AB piece doesn't tell us how much fraud has reduced by the implementation of additional authentication. It only regurgitates RSA's FUD.  It would also be useful to know if this trojan has been successful or just "seen in the wild".

This article also demonstrates why banks have worse security than gmail or your online gaming system: Banking is a terrible market. WiKID is, honestly,  a lot better form of authentication for online banking than SMS. We can do transaction authentication using different keys and mutual https authentication even do some transaction signing using our keys if banks wanted that.  But, there are in the U.S. maybe 8-10 banks that buy their own software and 2-4 companies that buy/manage the software for all the other banks.  Then, there are large vendors that spend so much money advertising that they get puff pieces written in Banking magazines and have legions of VPs to wine and dine banking VPs.  We don't want to  be in that market.  Too many vendors, not enough buyers.  Classic Porter analysis.

That's why we like that enterprise two-factor authentication market.

Hat tip (?) to Bruce Schneier.

• ← HTML5 Token
• Notes on Twitter's two-factor authentication →