Should WS-Fed, Mozilla's Persona or OpenID ever be used with a Banking application?

Question

Most banking sites I've seen use a sign in process that is proprietary, or otherwise won't integrate with an external IDP.

• Should banks offer integration with services like OpenID, WS-Fed, or Persona systems?

• Should a bank use those technologies (WS-Fed, Persona, or OpenID) even if they are "closed" and not federated with 3rd parties?

My desire for this is because they can offer multi factor authentication services even if the target web app doesn't support multi factor.

Update:

If a bank supported such a scheme, would a second challenge be useful / appropriate? (Password, OTP, Etc)

Answer 1

I think that banks should keep their systems closed and have stricter security policies than most OpenID providers. Imagine logging into your bank account using Facebook, Gmail or other providers. This would highly increase the attack surface.

Most banks have hardware tokens for their web banking sites and several others security features in place to protect your transactions. Common setups involve:

• Primary authentication using an username and a password
• On every sensitive operation while logged in, a token generated by the hardware device is requested
• A message is sent to your email/phone with details about transaction that have been made an exceed a certain amount.

Banks have a very sensitive environment they have to protect and relying on third parties for the authentication is not the best solution.

They should have strong systems in place that they can be audited at any moment and they should also be able to deal with any security incident (have logging mechanisms, alerts for abnormal behavior ,etc).

If your bank does not already have multi-factor authentication then they are one step behind in respect to their web application security.

Answer 2

Banks should keep their authentication closed rather than using a 3rd party.

1. Control of Risk: banks need to control their risks, and using a 3rd party authentication system introduces risks out of their control. This may change as 3rd party systems develop
2. It would make 3rd party authentication systems even more of a target. If banks all started using OpenID all the crackers would be targeting OpenID as success would give them access to a huge variety of accounts. Having a whole bunch of different authentication systems may be bad in some ways, but at least it keeps the nerds with the black hats busy.

Answer 3

While systems like OpenID are great from the standpoint of allowing shared credentials that are secured by a party that is (hopefully) trustworthy, they are problematic when it comes to financial activities since the bank has no control over the third party's system and has very little way to detect if the remote provider has been compromised. (Though I'm sure if a million Facebook users suddenly logged in and started saying to send the entire available balance to some random Russian account, it might indicate a problem.)

Ultimately, shared credentials in general is a bad idea, particularly when going across different levels of sensitivity to risk. While OpenID lets you limit the potential damage some by allowing it to only be stored in one place and thus, has a smaller attack surface and is more easily updated, it's still putting a lot of keys on one key ring.

I run my own OpenID server, but I'm not even sure that I would want to use my OpenID for my financial transactions as those accounts are all grouped in a security category significantly above any other day to day accounts.