August 14, 2012 at 10:09 am #7796
Why are so many companies finding it hard to have a good way for end user to login to their account?
Recently in the news there have been a few passwords leaked where companies cant even do the basic of encrypting passwords and adding some salt to them. A lot of sites still wont let you add symbols and dont allow over 40 char passwords. Many comapnies still force you into using number and letter and that is it. In this day and age why is every site not using two way authentication?
For me I dont see why everyone is not using two way authentication it seem like more seucre way to go. Dont get me wrong within time this maybe broken but at the moment its the best thing we have.
There are lots way to set it up you can using a mobile like Paypal, online banks and other companies are using. There are also even yubico that are not expensive that can be used for two way authentication.
Do you think its time we moved to a two method authentication system for every website nd every system we use ?
something I have, and somthing I know is the way to go !!
August 14, 2012 at 12:08 pm #48876RoleReversalParticipant
I think the biggest problem is user acceptance.
You and I may understand the need for two-factor authentication, but Joe Bloggs just wants to access his free email account to share pictures of cute cats. And whilst the cost of 2FA may be relatively cheap (and getting cheaper), if it’s still an additional cost to access a ‘free’ service, most users will complain and look for alternatives.
In the UK, most banks now utilise personal chip and pin readers to provide access based on account cards. But despite banks providing these free to account holders I still know people that complain about the extra ‘inconvenience’, unable to understand why a simple user/password isn’t enough.
Thankfully things may be changing, and I think as more services move to a system where users can choose to implement improved security to access their accounts (whilst I’ve not used it, Google’s mobile phone authentication is a good example) acceptance of more stringent authentication requirements should improve in general users over time; whilst allowing the truly (and rightfully?) paranoid increased security precautions sooner.
August 14, 2012 at 12:14 pm #48877m0wgliParticipant
I’d imagine many companies wouldn’t consider the additional cost and time of implementing two factor authentication to be worthwhile. The trade off between usability and security also being a major consideration.
Depending upon it’s implementation two factor authentication can also have it’s own issues:
Where additional security measures are available I’ll use them but I know plenty of people who don’t even when I’ve told them about them.
August 14, 2012 at 12:30 pm #48878
Yah some good points made but the problem is always going to be the end user and I think its our jobs as security people and websites to educate their user by explaing why they need to do somthing rather than forcing them or telling them.
Big companies have the money to educated their user but who is training home user and until we break this where home user are gettign educated security is alway going to be a hugh issue. As home user are taking their bad habbits to work with them and its just a circle.
Many of the banks in the Uk do use devices for authentication but how of the banks really explained why they are using them. I think if you said to anyone this device will help reduce the change people can get access to your money most people would want the device. Instead banks just send the device and say you must use this so people see it as a pain and dont really understand why.
August 14, 2012 at 10:30 pm #48879DataDwarfParticipant
It’s a cost/risk analysis.
How much will it cost to implement better security? Remember that some of these systems are running on legacy code. Much of the banking systems in the world are FORTRAN/COBAL. These legacy systems would have to be rewritten from the ground up. A HUGE undertaking as at a HUGE cost.
How likely is a breach and how much will it cost if/when it happens?
The simple fact is that the cost of a security breach is much less then the cost of upgrading the vast majority of these systems to a higher level of security.
August 15, 2012 at 8:23 am #48880
Some good points but on the other what price do they put on their reputation. Being hacked and having all your customer passwords leacked i think would cost more in the long run.
August 15, 2012 at 8:35 am #48881m0wgliParticipant
You would think that their reputation would be damaged, but in reality it seems that little actually changes. The vast majority of people still continue to use their services.
Take LinkedIn for example, how many people stopped using it? Their share price even actually rose after the breach.
August 15, 2012 at 12:06 pm #48882
That is shocking just goes show how many people dont have a clue about things
You must be logged in to reply to this topic.