So I was thinking about this today, you know how people carry around those key chains with a seemingly random number generator that’s used as a password? I have one issued by my company, and the way it works is, to access this thing (this resource, whatever, I’m trying to be generic about it), I type in the number showing up on my key chain at that very second, PLUS my password. You can read up more about two-factor authentications here.
Basically, the upside of using this RSA SecurID key chain I have, is that even if someone were to find out what my password is, without knowing the number showing up on the key chain (which changes every 60 seconds), my password is useless. So they would require physical possession of my RSA SecurID token. This is great, because if my password got leaked to say, some random guy in Russia, and I’m here in the US — he is going to have to come a long way to get my token, that is, if he can get it out of my kung fu grip. Likewise, the possession of my SecurID token without knowing my password is equally useless. I could show you the number on the token, but without my password you can’t gain access to anything.
I realize that some banks actually issue these hardware random number generator “tokens” to customers. Now that’s a great security practice, but these tokens are not cheap. I think they cost about $20-40 per unit. I’d imagine how costs would stack up once the number of customers start growing. Anyway, so my idea is this — we know that most people today have cell phones, and most people have a cell phone service where they have caller-ID (the ability to see the number that is calling them). Let’s say a big bank here in the US were to buy up 1,000 phone numbers. Then, whenever their customer wants to login to their website online — one of these 1,000 phone numbers would call the customer’s cell phone. This number would be then used in conjunction with their password to access the site.
Basically, we’re turning your cell phone into a RSA SecurID token. If some bad guy knew your password, UNLESS they also have possession of your phone, they won’t know the right number to punch in. They could guess, but first of all, they would need to know the 1,000 numbers the bank first possesses. That’s hard to figure out. The bank could do better than 1,000, perhaps 10,000. And, they could rotate the numbers. Meaning, buy 1,000 phone numbers, use these for 2 weeks, sell off these phone lines for another new 1,000 numbers.
The other requirement would be that after one of these 1,000 numbers call you, if you do not login to the website within say, 3 minutes, it will be invalid. So if you take longer than 3 minutes (perhaps you got interrupted, picked up a phone call, whatever), then the bank will just have to call you from another number.
So let’s recap how difficult it is to break this system. An online bank robber would have to know your password, and steal your phone. What if they have your password but dont have the guts to steal your phone? Can they do without the phone? Let’s see what they would have to guess without your phone.
- US phone numbers have 10 digits. Each digit goes from 0 through 9. So anything from 000-000-0000 to 999-999-9999 is possible. That’s 10 billion numbers
- Of these 10 billion numbers, you have to figure out how many of these actually belongs to the bank. Let’s take a conservative approach and say the bank has 1,000. So your odds are 1,000 divided by 10 Bil or a chance of 0.0000001. That’s a pretty darn small number. As a virtual bank robber, you wouldn’t know this exact number anyway. Unless you have an insider working for you who knows. This should be a highly guarded secret
- Now let’s say, these 1,000 numbers change on a bi-weekly basis. The numbers were hard to guess to begin with, and now they are constantly changing. So if you knew that a bank had 123-456-7890 as one of it’s numbers today, that may no longer be true tomorrow.
The added security benefit is this: If you were at the beach and you saw one of these numbers call you, you would know instantly that someone is trying to login to your bank account online.
There are many variations of this, such as, you could have a bank call up your cell phone from the same number over and over, but instead of looking at the number that just dialed you via caller ID, you pick up the phone, and a machine’s voice reads out loud at 10 digit number to you (great for customers with no caller-id). Or, the bank sends you a SMS text message with some number (also great for people with no caller ID). Whatever. The point is, your cell phone could be used by the bank as a second authentication mechanism.
For customers who don’t have cell phones, they probably don’t have electric in their homes. So they probably won’t need a bank account anyway. Or if they did, they wouldn’t have computers, so there would be no need for this anyway 
And this business model “scales” very well. The bank pays the initial cost of having such a service in place, and then for every new customer, there’s virtually no additional cost. With the RSA SecurID token, they’re paying $20-40 for EVERY single customer they sign up.
Perhaps now that I’ve said this, I’ll hear of a startup doing exactly this, and then selling it to banks.
Update 7/5/2007 – http://www.pcbanker.com/ has some of the best interest rates for CHECKING (not savings) account, and they provide their customers with the RSA SecurID tokens. Thanks Nigel.
We had about 17-18 software + hardware folks (and one reporter! we have no idea how that happened). The venue was perfect, people brought snacks, drinks, lawn chairs, and we ordered pizza. Most of the attendees are not surprisingly, from the San Diego Hacker News meetup.
