I have a burning question.



Shouldn't the banks have figured out how to authenticate their online banking sessions using PC's before they started introducing Mobile Banking?



They're not going to do the username/password thing again are they? Didn't they hear? That doesn't work.



It's not that there isn't a solution. Again, the easiest, most trusted and most familiar method to authenticate the online banking session is to do what we do at an ATM.



Hundreds of millions of Americans are both familiar with the process and trust it. The banks seemingly trust it as well (or they wouldn't give you $200 at 2:00 AM two thousand miles away from their main branch when you swipe your bank issued card and enter your bank issued PIN.)



So why do banks still ask us to "type" in our username and password? What don't they get? (cause keystroke loggers, phishermen and online banking trojans all seem to get it)



Here's a rhetorical question for you...



Do you think that banks would trust an easily obtained "username and password" to dispense cash from their ATMs? No?



Then why do they push this antiquated Login method for online banking? Don't they understand that all they are doing is creating a gateway for the bad guys to obtain sensitive online banking credentials.



The long and the short of it is that banks still haven't introduced a viable authentication platform for online banking (such as using a PCI 2.0 Certified PIN Pad for two factor authentication) and now they are going to simply "shrug their shoulders" and introduce mobile banking platforms.

I have a burning question.



Shouldn't the banks have figured out how to authenticate their online banking sessions using PC's before they started introducing Mobile Banking?



They're not going to do the username/password thing again are they? Didn't they hear? That doesn't work.



It's not that there isn't a solution. Again, the easiest, most trusted and most familiar method to authenticate the online banking session is to do what we do at an ATM.



Hundreds of millions of Americans are both familiar with the process and trust it. The banks seemingly trust it as well (or they wouldn't give you $200 at 2:00 AM two thousand miles away from their main branch when you swipe your bank issued card and enter your bank issued PIN.)



So why do banks still ask us to "type" in our username and password? What don't they get? (cause keystroke loggers, phishermen and online banking trojans all seem to get it)



Here's a rhetorical question for you...



Do you think that banks would trust an easily obtained "username and password" to dispense cash from their ATMs? No?



Then why do they push this antiquated Login method for online banking? Don't they understand that all they are doing is creating a gateway for the bad guys to obtain sensitive online banking credentials.



The long and the short of it is that banks still haven't introduced a viable authentication platform for online banking (such as using a PCI 2.0 Certified PIN Pad for two factor authentication) and now they are going to simply "shrug their shoulders" and introduce mobile banking platforms.

Here's an interesting release from Gemalto regarding the success of their "PINsentry" device in the U.K.

I consider this to be a very strong "Proof Of Concept" as one may easily draw a direct analogy between the PINsentry device and HomeATM's Wedgie. Both are peripheral devices and uptake seems to be going much better (30% better) than projections, with over 1 million devices being used by Barclay's bank customers for online banking.

While a sentry stands guard, HomeATM's device puts a "wedge" between the fraudster and the consumer. Either way, the PINsentry device experienced ZERO FRAUD according to Gemalto's press release:

Define Wedge:

1. "something solid that is usable as an inclined plane that can be pushed between two things to separate them...(as in "consumers and fraudsters"!) And to think that all those years leading up to my experience with HomeATM, I had thought a Wedgie was something to do with pulling someone else's underwear up to their ears from behind!

2. A wedge decodes "read" data (i.e. bar codes, credit cards) and communicates that information through a keyboard port on a computer. The keyboard plugs into the wedge and the wedge device plugs into the computer where the keyboard was. Sophisticated wedges can accept a few different peripheral devices. I think the second definition was the basis for the name, but anyway...here's the press release:

Gemalto has announced that over one million Barclays Bank customers in the UK are using its cryptographic smart card reader, called PINsentry by Barclays, to provide stronger authentication for online banking.

Here's their release:

According to Gemalto, "the bank started deploying its strong authentication program in July 2007 and not one PINsentry online customer has suffered fraud since then. User feedback has proven extremely positive and Barclays observed that customer acceptance was higher than anticipated by 30 percent.

Editor's Note: ONE MILLION in ONE YEAR with ONE bank...with 30% higher adoption rates than anticipated... and ZERO FRAUD! ..."thanks for the pilot!" This data should eradicate any hesitancy as to whether consumers would adopt a peripheral to enhance their private data and security.

"With PINsentry, not only do Barclays customers easily generate one-time passwords to authenticate themselves at login, but they also use it to sign transactions, which provides a much higher level of security than just authentication using static credentials. All that they need to do is insert their usual chip-enabled bankcard into the PINsentry reader from Gemalto and type in their card Personal Identification Number (PIN) code. They carry the devices with them and can perform these secure online transactions from any personal computer.

PINsentry is convenient and remarkably easy to use, as evidenced by a recent Barclays usability study undertaken by Foviance, the digital customer experience consultancy. As part of the program, Barclays is now offering additional services to its online customers. The maximum amount for personal online transactions has risen from an initial £1,000 to £10,000 and plans are in place to offer international payment for the purpose of funds transfer worldwide in the near future.

Introduction of these new services demonstrates the high level of trust Barclays places in the system. “Our goal was to provide our online customers with an easy-to-use, highly secure product to protect them against fraud,” commented Sean Gilchrist, digital banking director, Barclays.

“Adoption of the PINsentry reader by one million cardholders in one year is a clear demonstration that we made the right choice.” "Making personal digital interactions more secure and enjoyable is second nature to Gemalto,” added Jacques Seneca, president of the security business unit at Gemalto. “The success of the deployment of our strong authentication and signature solution at Barclays rewards the effort we are putting forth in making life easier for online customers.”

Related articles

It's PIN...It's Smart...It's Embedded into the Future of Payments

• Chip and PIN Technology is Catching on with Merchants and Consumers
  
• Chip technology to help foil credit card fraudsters


• Internet stakeholders ponder ways to regulate the web


• Online Fraud Rises More than 100% (pindebit.blogspot.com)
• More European Chip and Pin Insecurity (schneier.com)
• IBM Agrees with HomeATM...Hardware Required (pindebit.blogspot.com)
• IBM looks to secure Internet banking with USB stick (infoworld.com)
• Gemalto Wants EMV in USA (pindebit.blogspot.com)
• Cambridge security boffins slam banking card readers (theregister.co.uk)
• Fraudsters Watch as You Enter PIN (pindebit.blogspot.com)