71

My bank recently revamped its website, and it changed for the better as far as I’m concerned. Especially, security seems to have been dramatically enhanced.

Most importantly, they introduced a rather unusual (I’ve never seen this before) identification method, which they call the ‘electronic certificate’. Basically, you have to go to the bank in person and the guy gives you a tiny, cheap USB stick with a very low capacity. From this point, you’ll be required to plug the stick into your computer every time you want to log in. The stick alone is not enough, you also have to type your password — basically, 2-factor-authentification with a USB device being the second factor.

How can this possibly work? Of course, I believe the USB stick to contain certificates/encryption keys of some kind, that are used in the login process, but they don’t require the user to install any software on the machine. I find it rather creepy that a website accessed from a sandboxed web browser, with no plug-in/module/app/toolbar installed whatsoever, can see the USB stick you just plugged in. And not only see this stick, but read it and use its content deeply enough to log you to the most sensitive level of your online banking app.

I am not a big fan of plugging unknown devices into my computer to begin with, and my warning light flashed when this was explained to me, so I went for another identification method (you can choose). I’m just curious.

PS: the measure obviously does not apply to their mobile apps, since smartphones don’t have USB ports, but that’s not a big deal because you cannot do much with their phone app (it's mainly a consultation app, not something you can actually make big payments/transfers with).

Edit: no open file dialog is used, which would make the explanation quite clear.

Improve this question
18
  • 2
    Any chance it's the USB stick that's providing the necessary drivers to wire itself into the browser?
    – John Dvorak
    Jan 6, 2017 at 8:25
  • 2
    Have you tested to see if you actually can log into your bank from a 'sandboxed web browser'? It may be that this key will only work with a non-sandboxed browser and the bank is assuming all their customers are running that way. Might be something to ask your bank about.
    – Mark Ripley
    Jan 6, 2017 at 8:32
  • 41
    I think you're missing some info here. It is possible to have a USB smartcard with embedded chip containing your cert and private key. The whole thing can be interfaced through PKCS#11 or Windows Certificate Store, granting access to any browser to the certificate associated with the token. That, however, will usually require the necessary device to be installed. Since you didn't give it a try (and can't provide detail on the stick itself), I'm willing to believe there is just a misunderstanding regarding the meaning of "out of the box"
    – Stephane
    Jan 6, 2017 at 11:12
  • 19
    I have a Yubikey USB dongle as 2 factor authentication. When I plug it in to the PC it installs itself as a generic keyboard, which all devices ive encountered accept. When I press a button on the front of the yubikey, it types a One-Time Password that the receiving website/program takes to authenticate with Yubicos authentication servers that I am using the key I have set up the account to be used with. As such i can plug it in to anywhere and enter the OTP in to anything without having to install anything.
    – James T
    Jan 6, 2017 at 12:31
  • 2
    I'd also expect the USB key would be a smartcard containing a private key which you use as a second factor. It could be that the OS already has these drivers or pulls them from Windows Update (which also happens for a lot or regular USB keys). But in most cases you'd have to install the client certificate on your machine first. When prompted by the browser, the OS will then try to retrieve the cert from the USB key if it's present
    – BlueCacti
    Jan 6, 2017 at 14:42

9 Answers 9

Reset to default
65

What your bank gave you is an USB security token with a digital certificate (like these). These are standardized hardware devices which almost every operating system supports plug&play out of the box. They are very common for implementing multi-factor-authentication to high-security systems in enterprise IT.

Your web browser uses HTTPS with client-based certificates to access your bank's website. It uses your operating systems certificate store to find an installed certificate which matches the identity the webserver requests. When you have a standard USB security token installed, the operating system will also look for any certificates on the token.

The operating system can not do the verification process with the webserver by itself, because the token doesn't allow to read the private key of the certificates stored on it directly. The token includes the hardware to do the verification. So the private key never leaves the USB stick. That means even if your PC is compromised by malware, the private key of the certificate isn't in danger of being stolen (but keep in mind that this method doesn't provide any protection after the authentication was successful. Malware can still screw with your web browser).

By the way: Which bank is that? If my bank would also support this authentication method, I might even start doing online banking.

Improve this answer
5
  • 4
    I think the OP was wanting to know more about the mechanism for how the USB drive provides security. Do you have any more information about how a USB security token like you describe would work for logging in to a bank website? It doesn't sound from the description that any sort of installation was necessary, nor were there any user prompts.
    – Thunderforge
    Jan 6, 2017 at 18:23
  • 7
    A USB security token will not work on every operating system. Aladdin tried for years and failed. The etoken driver for linux does not work out of the box and is not installed. opensc is also not installed at default. PLUS: You need to add the PKCS11 module to your browser...
    – cornelinux
    Jan 6, 2017 at 19:18
  • 2
    I think that what he is basically saying is that it is pre-installed into the OS, so there's nothing more needed to install.
    – Puppy
    Jan 7, 2017 at 17:52
  • 1
    Keep in mind that while the dongle is plugged in any malware will have the same access to the certificates as the browser has so it's not something to keep plugged in.
    – ratchet freak
    Jan 9, 2017 at 13:12
  • 1
    Note that this only applies only to applications using the Windows certificate store. A prominent example of this behavior are Chrome and Edge. Firefox OTOH will not work without a PKCS#11 module.
    – SEJPM
    Jan 9, 2017 at 17:11
28

One way it could work is that Chrome supports FIDO U2F without plugin. Given that now Chrome is now the most popular browser and that Chrome runs on Windows, Mac, and Linux, it's not totally incorrect to claim that "it works in any device that has a USB port, Windows, Mac, Linux and more, and to work out of the box".

Did they claim that it works in any browsers or just any OS?

Improve this answer
4
  • 1
    That doesn't tally with the bank's claim.
    – Julian Knight
    Jan 6, 2017 at 15:07
  • 7
    +1 This sounds right. It's an open source mechanism, which means it's likely implemented by Microsoft/Linux/Apple. Of course, the bank's claim that it works on any computer with a USB port is nonsense. I have a box that runs MenuetOS, and I can pretty much guarantee it won't work with that OS.
    – phyrfox
    Jan 6, 2017 at 22:57
  • 1
    @phyrfox Well, technically it works with nearly any device that has USB port, you just have to install Linux first.
    – Hannes Karppila
    Jan 9, 2017 at 15:26
  • @phyrfox: well quite. I have a box I just scrubbed clean, with no OS installed at all, let alone a browser, and it doesn't work on that either. I guess when a bank says "any computer" or "your computer", read the small print, they don't mean any computer I might own. And they aren't guaranteeing anything anyway, it's not like I can demand my money back when it doesn't work on my Atari ST.
    – Steve Jessop
    Jan 10, 2017 at 12:53
25

....they don’t require the user to install any software on the machine.... I thought that the ability for a webpage to browse the file system freely without user action is too commonly restricted by default

Yes, that should definitely not be possible without smartcard drivers. This is a fundamental security mechanism of any browser. What gives the clou that the certificate is read without clicking an "open file" dialog, a Java dialog or pre-installing drivers? You said you chose another verification option.

This sounds like the USB key used, for example, by the Bank Of China. Such technology is described here.

was said to be compatible with "any device that has a USB port"

Having a PKCS#11 cert, or a #12 to combine with a passphrase will work on all OSses. This is the same way password managers like keepass work, combining something you know with something you have to get 2 factors of authentication.

Improve this answer
9
  • 2
    Then it still could be a pre-installed browser plugin or smartcard driver. You were right on your analysis, there should be no way "out of the box" to do this, but with popup or some small user interaction, this does make sense.
    – J.A.K.
    Jan 6, 2017 at 9:33
  • 4
    @Zazor: I think you do not own such a stick. How can you know, there is no open file dialog?
    – cornelinux
    Jan 6, 2017 at 19:16
  • 3
    @cornelinux I plugged a stick of my own then tried to log to the website. It stated "your key is not valid" but I could see the login interface does not ask the user to open a file
    – user135452
    Jan 7, 2017 at 4:57
  • 2
    @J.A.K. no, I had my own USB stick plugged in. It's totally unrelated to the identification process; I just wanted to test what happens when you try to login without the proper stick
    – user135452
    Jan 8, 2017 at 8:19
  • 3
    The login application will match the USB by its type or manufacturer. I don't think you will get any information from throwing a random USB in the mix.
    – J.A.K.
    Jan 8, 2017 at 13:45
12

It's probably just a USB smartcard reader, with inserted SIM sized smartcard.

Manual installation of drivers is not needed since at least generic drivers for both reader and card are already installed in most modern OSs.

See the image below for example of such device:

Photo of USB device.

There is certificate with private key stored on that SIM smartcard inside reader. When you plug it in the computer, that certificate from smartcard gets loaded into OS certificate store. From there on it basically behaves just like any other certificate which is saved on computer and can be used for accessing secured resources, signing documents/mail, encrypting stuff, etc.

This one in particular is issued by Cert Authority which is trusted by my bank (web banking) and State (mostly used by me for IRS related stuff and requesting real documents).

Improve this answer
8
  • 4
    "When you plug it in the computer, that certificate from smartcard gets loaded into OS certificate store" What you describe, if true, doesn't seem to be a feature, but a security hole in the OS. I'd be worried if anyone could plug a USB stick into my computer and upload arbitrary files.
    – chue x
    Jan 8, 2017 at 17:57
  • 2
    It's not arbitrary file that's get loaded into computer, but a digital certificate, which by itself cant do any damage - presuming that the implementation of whole digital certificate handling stack of software had been done correctly in the OS (which most definitely should be) Also, you don't just stick random USB sticks and let random USB sticks be stuck into your computer. If you do that, the computer can be considered compromised anyway.
    – user2720406
    Jan 8, 2017 at 22:51
  • 2
    @chuex, that is literally the point of USB sticks.
    – Stack Tracer
    Jan 9, 2017 at 1:43
  • That wouldn't work with all OSes though - definitely not Linux at least (I have yet to see a distro which includes OpenSC out of the box).
    – André Borie
    Jan 9, 2017 at 9:30
  • 1
    @StackTracer Not every small USB devices is a file store ("USB Flash Drive"). Cf. Phillip's answer.
    – jpaugh
    Jan 9, 2017 at 17:15
11

It's most likely a device that pretends to be a keyboard and is thus recognized by any OS without requiring special drivers. Internally, it would probably use HOTP (or TOTP, if it had an RTC chip and a battery) and just "type" the OTP each time the button is pressed, like a Yubikey or similar U2F device.

The browser doesn't talk nor know the USB is there; it just instructs the user to press a physical button on the device (to tell the device to "type" the code, as the browser itself can't talk to it) and then interprets whatever keystrokes (up to the length of the code) it receives as coming from the device.

Improve this answer
6
  • You're suggesting something similar to a Yubikey I don't think that tallies with what the OP described.
    – Rob C
    Jan 6, 2017 at 9:49
  • 3
    @RobC this is most likely the only solution that fits the bill for WIndows/Mac/Linux compatibility without requiring drivers. Anything else would require either a browser plugin, a driver, or both, which definitely doesn't correspond to what the author described.
    – André Borie
    Jan 6, 2017 at 10:25
  • 3
    I agree with Rob, it seems unlikely that a bank would use that solution. If the USB stick would emulate a keyboard, how would it intercept these responses in the browser and reply a token? It would interact with the computer which would look very creepy to the average user. I can't think of a clean way of achieving what the OP described by using a keyboard emulated USB. As mentioned by J.A.K., the OP didn't use the USB stick so there might be some installation, approval required by the user.
    – Silver
    Jan 6, 2017 at 10:50
  • @Silver there is no interaction needed between the stick and the browser. It's just a second factor like TOTP or HOTP.
    – André Borie
    Jan 6, 2017 at 10:55
  • 8
    @AndréBorie, that could work. You could test it by pressing the button in a notepad window. This would require the user to have the TOTP field focussed in the browser. There is too little information to figure out what the mechanism is though. Maybe the OP can specify the bank that is using this so everyone can do more research.
    – Silver
    Jan 6, 2017 at 11:04
9

Sounds like a theoretical idea I had about a decade ago.

Pretty much every OS supports USB network devices. Your USB stick may pretend to be a network card, connected to a a local network, with a webserver on that network too. That webserver can have HTTPS certificates, too.

Your webbrowser can make HTTPS requests to that webserver, and discover that the USB stick and bank website trust eachother. This isn't considered a sandbox escape, because neither the browser nor the OS know that the webserver is actually on the USB stick.

IP warning: to the best of my knowledge, my former employer holds a patent on this idea in most jurisdictions. Contact a patent attorney before copying this idea.

Improve this answer
8
  • 4
    @Marcel The web server on the USB device could set a static IP for its own. The web application can then connect to that IP address. E.g., the web server could set its IP to 12.34.56.78 and the web application could then load a resource like 12.34.56.78/.well-known/verify-user/[unique-id] and then verify the resource actually loads (and maybe check it's contents)
    – BlueCacti
    Jan 6, 2017 at 14:36
  • 2
    Basically, PoisonTap (samy.pl/poisontap) for good?
    – Matthew
    Jan 6, 2017 at 14:54
  • 4
    Wouldn't adding a network card be a privileged operation restricted by the OS?
    – Josh Sanford
    Jan 6, 2017 at 14:57
  • 1
    @JoshSanford Unfortunately, it is not restricted on Windows. See grc.com/sn/sn-576.htm, find "USB network adapters"
    – Marcel
    Jan 6, 2017 at 15:07
  • 2
    @Marcel: And the domain name could be usbstick.example.bank since the bank knows what IP the device will be claiming. This would take a single /30 that can be shared across all USB sticks of that bank. Even better, you can also have the same IP on the public internet. The PC will choose the better route (local) when the USB is plugged in, and the worse route (internet) when not. The latter webserver will just serve an image "Plug in your USB stick!".
    – MSalters
    Jan 6, 2017 at 15:24
7

As some of the other answers mentioned, this is most likely a USB security token. Think of it as a smart card reader + embedded smart card (and sometimes they are actually implemented this way). Think CAC card used by US defense organizations. Think PGP card. Some Yubikey models also support acting as a smart card.

This kind of devices is widely used by banks in China to protect their online banking website / desktop client software, and my answer is mostly based on my personal experience using these tokens in China.

How do you use it?

When you sign up for online banking and opt for a USB token, the bank gives you the token, creates a public/private key pair and your personal certificate, and load those into the token. You set a password on the token, which is separate from your online banking login password.

You install the driver provided by the bank on your personal computer, plug the token in, and navigate to the bank's website. Whenever you log in or perform a sensitive operation (transferring funds, changing contact information, authorizing online purchase, etc.), the browser / operating system prompts for your token password, the light on the token blinks for a few seconds, and the transaction goes through.

Wait, I have to install drivers?

Yes. The Windows operating system has a standard smart card interface, but each model of USB token still requires a driver. Very rarely, Windows Update will install the correct drivers for you, but in most cases you will have to download a package from the bank's website.

Often the only supported operating system is Windows, and the only supported browser is IE. (They like them some ActiveX.) It is certainly possible in general for smart cards / USB tokens to support other OS / browsers, see CAC card above; you have to check compatibility with your own bank.

So how does it authenticate you?

The browser asks the OS to ask the token to sign a small piece of data (perhaps your transaction details). The token signs it, using your private key and certificate. The browser sends the signature to the bank. The bank verifies the signature, and is satisfied that only the token they gave you have the private key to produce this signature.

The private key never leaves the token. If properly designed, the token should never divulge the private key.

Improve this answer
5

First of all, let me state that I am quite skeptic of the claim by a non-technical employee that it works on "any device that has a USB port", regardless of browser or OS. I wouldn't be surprised if the supported OS turned out to be just a couple of Windows versions (and, maybe, MacOS). However, it is interesting to think how such a device could work.

Most solutions not requiring drivers, like the André Borie proposal of a usb keyboard, would require however some extra interface (like a hardware button).

Still, the post of user2720406 gave me an idea for a device that would indeed work [on certain places] for any [switched on] device that has a USB port:

The usb device would simply a contain a SIM card, using that to access the internet on its own through GPRS/3G. Then the device would simply send digitally signed messages of «Customer with token 12312121 is using online banking». The online session is not allowed unless one was received in the last 5 minutes (plus maybe other factors, like the IP of the customer having a similar geolocation to the IP of the device). Thus, the usb port would only be used for power, and the device be completely independent on what is installed on the computer.

Improve this answer
3
  • It just announces as a keyboard.
    – jorfus
    Jan 6, 2017 at 22:47
  • 4
    Can't think of a reason why this wouldn't work. Great out-of-the-box thinking.
    – Oliphaunt
    Jan 7, 2017 at 8:34
  • 1
    OP could test this by plugging the device into a different computer than the one he is logging onto the bank site with.
    – chue x
    Jan 8, 2017 at 17:51
2

This sounds like a Yubikey. They're well known and work great. https://www.yubico.com/products/yubikey-hardware/yubikey4/

  • Regarding not needing drivers: The Yubikey identifies itself as a keyboard so any machine with a keyboard driver can read the text output from it.
  • How it works: You push the button and the Yubikey issues a public key (from a secure private key embedded in the device). The bank can then authenticate you and confirm that you have the thing you know (your password) and the thing you have (your physically secured private key).

  • Why it's secure: It's not possible for software on your computer to get access to your private key so malware cannot copy the key and pretend to be you. It would have to be physically stolen from you. (which is possible, but that's why you pair it with something you know)

  • Who uses them and why: Google helped design the yubikey so they could solve the problem of malware on a computer grabbing local credentials while the user was not present. Every Google engineer has one. I've used them for years and deployed numerous 2fa solutions around them.

Improve this answer
5
  • According to the website yubikey also identify itself as smartcard and smartcard reader.
    – Lucas
    Jan 6, 2017 at 22:57
  • The YubiKey uses generic drivers already available in Windows: For the YubiKey Standard / Nano, and any device with an OTP mode (Edge, NEO, etc.): Keyboards > HID Keyboard Device (same as plugging in an external keyboard)
    – jorfus
    Jan 6, 2017 at 23:17
  • On newer operating systems it probably gets identified by name, but my point is, it works fine on any machine I've ever plugged it into. I've never seen a "unknown device" warning.
    – jorfus
    Jan 6, 2017 at 23:18
  • If it types in, then it sounds like it is just text that could then be captured by the user or malware and used separate from the device.
    – MikeP
    Jan 8, 2017 at 1:45
  • Absolutely, this is simply a one-time token. Malware containing a key logger will always be able to log the password and the OTP (even if you're typing in the OTP from a keychain fob). What this prevents is the malware from exfiltrating those credentials and using them again later.
    – jorfus
    Jan 9, 2017 at 23:26

You must log in to answer this question.