banking

flodis79

When will Irish internet banking be more secury?
I'm used to Swedish internet banking, where you have
a special digipass to calculate random codes when you
pay bills, etc.

Will this come to Ireland?

Random

Ulster Bank internet banking involving you generating a shared security cert between you and them. Means more security, but you have to copy the cert onto another pc if you wanna use it on it.

AIB and BOI have 8 digital reg codes, 5 digit pins and generally some numbers out of your credit card number or something.

I prefer AIB and BOI because I can get them from anywhere.

vector

ciaranfo wrote:

Ulster Bank internet banking involving you generating a shared security cert between you and them. Means more security, but you have to copy the cert onto another pc if you wanna use it on it.

AIB and BOI have 8 digital reg codes, 5 digit pins and generally some numbers out of your credit card number or something.

I prefer AIB and BOI because I can get them from anywhere.

You know the AIB code, where it asks for 2 of your 5 pins.

Click refresh, again, and again and it keeps changing.

So a criminal could get by with ANY 2 numbers

(Granted they would still need the reg number and homephone/last4creditcard)

Frank Drebin

I've been using AIB internet banking and my wife's been using bank of ireland internet banking for the last 3 years and we've haven't had any problems yet!
And we use internet banking a few times a day, every day.

dogs

I worked on the corporate banking side of things for a particular bank and the most practical solution they devised was based on three points...

1. A key pair was generated for every account and used for initial authentication and for verification before transactions.

2. ACLs typically with only one priviliged user per organisation whose responsibility it was to give the final authorisation to any payment instructions.

3. Probably the most important bit; the PC used for access was not connected to any network, accessed the bank via dialup, didn't answer any incoming calls and was not used for any other purpose.

And of course, everything wrapped in SSL.


There's probably not a whole lot there that carries over to home banking; it all boils to down to either something you have and something you know. Generating a seperate key file is a big improvement on 8/16 character passwords but it's still just one file that needs to be compromised...

It's not an easy balance to strike either, too many hoops to jump through and your customers won't.