on americans, subway doors, and internet banking…
Tuesday, December 6th, 2011 at 9:01 pm by Brian Ales
It’s interesting how online banking in Germany differs from online banking in the US…
Arguably, they’ve been at this electronic banking thing over here longer than we have in the states – in fact, the routine writing of personal checks ended in Germany sometime well before the end of the last century. But while the move away from paper has progressed much further here, funnily enough you can’t do any personal online banking at all in Germany without one very important sheet of paper: a TAN list.
A TAN list is a numbered list of unique codes (usually 50 per sheet). Each time you make a transaction online, your bank’s website prompts you for a random code from the list (i.e. “Please enter code number 43“). The idea is not only to present the user with an additional authentication challenge – a simple “What is your first pet’s name?” type of question accomplishes that – but to also make that additional challenge unique to the transaction.
Why is a transaction-specific authentication challenge important? It’s a way way to fight keystroke logging software – malicious code capable of quietly recording each and every keystroke you type (including, of course, passwords). Until recently, my US bank had been addressing the key logging issue a bit differently, requiring that I enter an additional “Security Key” by clicking on the keys of a virtual onscreen keyboard. That avoided the physical keyboard (and thus key-logging), but the problem remained that my single Security Key was static rather than unique to each transaction. As a consequence, if just one of my transactions was overseen (or screen-recorded), I could still be compromised.
…which is why they just changed over to the system shown below:
Read the rest of this entry »


Post your comments »









Previous Entries