Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Most banking sites I've seen use a sign in process that is proprietary, or otherwise won't integrate with an external IDP.

  • Should banks offer integration with services like OpenID, WS-Fed, or Persona systems?

  • Should a bank use those technologies (WS-Fed, Persona, or OpenID) even if they are "closed" and not federated with 3rd parties?

My desire for this is because they can offer multi factor authentication services even if the target web app doesn't support multi factor.


If a bank supported such a scheme, would a second challenge be useful / appropriate? (Password, OTP, Etc)

share|improve this question
An interesting approach would be a to set up a Scheme for identity providers with audited practices, 2FA, etc. - eg a set of OpenID providers that guarantee a greater level of authentication, commensurate with the greater needs of services such as online banking. – bobince Jan 16 '13 at 17:12

I think that banks should keep their systems closed and have stricter security policies than most OpenID providers. Imagine logging into your bank account using Facebook, Gmail or other providers. This would highly increase the attack surface.

Most banks have hardware tokens for their web banking sites and several others security features in place to protect your transactions. Common setups involve:

  • Primary authentication using an username and a password
  • On every sensitive operation while logged in, a token generated by the hardware device is requested
  • A message is sent to your email/phone with details about transaction that have been made an exceed a certain amount.

Banks have a very sensitive environment they have to protect and relying on third parties for the authentication is not the best solution.

They should have strong systems in place that they can be audited at any moment and they should also be able to deal with any security incident (have logging mechanisms, alerts for abnormal behavior ,etc).

If your bank does not already have multi-factor authentication then they are one step behind in respect to their web application security.

share|improve this answer
In my country, most if not all banks also require a client certificate for authentication. Authentication consists of a certificate + password. I wouldn't want them to use 3rd party authentication. I'd appreciate if they supported TOTP, but they don't. – Matrix Jan 15 '13 at 17:08
Sadly....Most US Banks have less means to detect an unauthorized access to my account then Facebook does. I would feel more secure accessing my account with a Google Account with an authenticator attached to the account. Of course I will never have a problem with protecting my bank accounts because of the steps I take to protect them. – Ramhound Jan 16 '13 at 17:36

Banks should keep their authentication closed rather than using a 3rd party.

  1. Control of Risk: banks need to control their risks, and using a 3rd party authentication system introduces risks out of their control. This may change as 3rd party systems develop
  2. It would make 3rd party authentication systems even more of a target. If banks all started using OpenID all the crackers would be targeting OpenID as success would give them access to a huge variety of accounts. Having a whole bunch of different authentication systems may be bad in some ways, but at least it keeps the nerds with the black hats busy.
share|improve this answer

While systems like OpenID are great from the standpoint of allowing shared credentials that are secured by a party that is (hopefully) trustworthy, they are problematic when it comes to financial activities since the bank has no control over the third party's system and has very little way to detect if the remote provider has been compromised. (Though I'm sure if a million Facebook users suddenly logged in and started saying to send the entire available balance to some random Russian account, it might indicate a problem.)

Ultimately, shared credentials in general is a bad idea, particularly when going across different levels of sensitivity to risk. While OpenID lets you limit the potential damage some by allowing it to only be stored in one place and thus, has a smaller attack surface and is more easily updated, it's still putting a lot of keys on one key ring.

I run my own OpenID server, but I'm not even sure that I would want to use my OpenID for my financial transactions as those accounts are all grouped in a security category significantly above any other day to day accounts.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.