Factor Authentication in Online Banking

Single Factor Authentication, Continued

Partial Transmission of Passwords/PINs is a step up from the chocolate fire safe - maybe to a hard plastic one. Again, it is very vulnerable to phishing, social engineering of all sorts, and key loggers, which will get the information they want after two or three successful logins. Despite that, it is by far the most used method in online banking today. Effectively, all the data necessary to break the login will become available through attacks on the PC, and instantly available through phishing and social engineering.

Scrabble Pads are a joke! Here, the user looks for the alternative letter that is provided onscreen and enters it in the password box. Unfortunately, all the information required for reverse engineering the password or PIN is on this page. The hacker essentially "has the screen", and the letters that are entered, so where's the security? Take a closer look:

My desktop Trojan with key logger and screen scraper says "thank you very much" to this sort of thing. It offers no resistance to phishing at all, as the password or PIN is the basis of the substitution, the 'cipher key' displayed onscreen.

And Virtual Keyboards are not much better...

As above, my screen scraper can see every button click, irrespective of the 'cipher' that is passed to the server. This also offers no resistance to phishing at all, because if the user has given up the password/PIN, then the virtual keyboard is irrelevant.