Phishing
Two-factor authentication is vulnerable to so-called 'man in the middle' attacks

Experts rubbish two-factor authentication

Technology will not cut phishing, e-Crime Congress hears

Written by Iain Thomson

Two-factor authentication will not help to reduce soaring phishing levels, experts at the e-Crime Congress in London warned today.

One UK bank is currently considering the introduction of two-factor authentication, where customers receive a key fob which displays a constantly changing password that allows them to access their online accounts.

But the technology received a resounding thumbs down from experts at the conference, despite being widely touted as the next generation of user security.

"There are a whole bunch of things that can go wrong with two-factor authentication," said Ross Anderson, professor of security engineering at Cambridge University's Computer Laboratory.

"Banks are resisting because their technical staff know that it will be expensive to introduce and will not be effective. Some banks will introduce it, it will be quickly broken and then quickly forgotten."

Anderson explained that two-factor authentication is vulnerable to so-called 'man in the middle' attacks in which a phishing site takes the pass code and uses it immediately.

Customers would also be vulnerable to muggings for their authentication tokens, and the technology would have no effect on other online crime.

Despite the technical failings of two-factor authentication consumer demand for the devices is high.

Joseph Sullivan, associate general council at PayPal, said: "We are looking at two-factor authentication.

"We were told that it would not be popular, but started a beta programme two months ago. Demand has far outstripped supply."

Tags:

reader comments

related articles

Phishing

Education failing to fight phishing

More integrated approach needed to stop theft 27 Mar 2007

 

Phishers crack two-factor authentication

Next-generation attack spells doom for security system 13 Jul 2006

Human factor essential for IT security

People and processes more important than technology 26 Oct 2006

Pointsec adds two-factor authentication

Stronger encryption software for laptops and desktops 31 Oct 2006

Review 2007: IT security and e-crime

Computing's review of the year looks back at the top IT security and cybercrime stories 20 Dec 2007

ID cards criticised as "fairy tale"

National Identity Register could increase risk of fraud, say academics 27 Nov 2007

Thieves to target new technologies

New surveys find that tech-savvy criminals are seeking new targets 29 Nov 2007

related whitepapers

today's top stories

Learning from the credit crunch to avoid a broadband crunch

While it might be the most pressing issue de jour , the financial system isn’t the only area where government needs to... 10 Oct 2008

How careerism can warp IT procurement

Many working in IT put their career interests before those of their employer when weighing up purchasing options 10 Oct 2008

City in pressing need of skilled IT matchmakers

With the financial services sector plunging ever deeper into an M&A maelstrom, IT leaders are having their systems integration skills and due diligence expertise tested as never before 09 Oct 2008

The definitive guide to software development

Five key trends and five best practice tips to help you improve your programming capabilities 09 Oct 2008

Computing podcast - IT implications of the banking crisis, and the FSA clamps down on IT security

We discuss the effect of shotgun mergers and acquisitions on financial services IT staff, and examine the industry regulator's plan to fine directors for information security breaches 09 Oct 2008

Advertisement

Newsletter signup

Sign up for our range of FREE newsletters:

Existing User

Newsletter user login:

Jobs

Related jobs

Job of the week

Job alerts

Sign up here

Find your next job


IT Salary Checker

Check salary here

Advertisement

White papers

Search white papers

Top categories

VPN, Extranet and Intranet Solutions

WAN/ LAN Solutions

Network Security

Interoperability-Connectivity

Grid/ Utility Computing

Latest poll

Would you apply for a job that was advertised on Facebook or a similar social networking site?

Would you apply for a job that was advertised on Facebook or a similar social networking site?

The government is using Facebook to recruit IT staff - would you apply to such an ad?

Previous poll results

Latest audio and video articles

programming codeVideo

The definitive guide to software development

Five key trends and five best practice tips to help you improve your programming capabilities 09 Oct 2008

Podcast imageAudio

Computing podcast - IT implications of the banking crisis, and the FSA clamps down on IT security

We discuss the effect of shotgun mergers and acquisitions on financial services IT staff, and examine the industry regulator's plan to fine directors for information security breaches 09 Oct 2008

Latest in-depth articles

Financial Services Authority buildingAnalysis

FSA threatens executives with fines

Senior management to be held accountable for security lapses at banks 09 Oct 2008

Comment

Broadband must be a spending priority

For the economic health of the nation, the government would do better to bankroll an optical fibre rollout rather than prop up profligate banks 09 Oct 2008

Advertisement

Primary Navigation