I have an account with a bank that has additional security option.
When it does not recognize a device being used to access the account, it will either:
- Prompt with 1 of 3 security questions
- Send a one-time token via text message to cell phone.
I determined that it "recognizes" a device via cookie (when I clear my browser cookies is when it prompts me again for the additional security option).
Let's assume that the security questions / answers I have chosen are not subject to social engineering from browsing facebook/linkedin/etc.
Just had a few questions:
Can anyone help me enumerate all the reasons that the one-time token is more secure than the security questions? Here are some one of the ones I could think of:
- It is true 2 Factor: what-you-know (login/password credentials), what-you-have (cell phone).
As opposed to what-you-know (login/password credentials) and another what-you-know (secret question/answer) - It is dynamic and only provides access for a given amount of time.
- Are there others I am missing?
- It is true 2 Factor: what-you-know (login/password credentials), what-you-have (cell phone).
Is the fact that they are using cookies to "recognize" a device and thus no longer prompting for the one-time token subverting this security mechanism (like putting an iron gate out front and leaving the back door unlocked)?
Have an account with a different bank that uses similar security. However, when I clear my cookies, they still recognize my device. I would assume they are tracking the known device(s) by IP Address and possibly other HTTP header information. Would this be a better / more secure way to "recognize" than the cookie?
Thanks,