@AviD Yeah, I saw that post, waited around on Chat for you to show up so I could be an asshole. Then after a few days actually read the rest and figured it out

Anyone know what U.S. banks offer two-factor authentication? (Would that be okay as a question here?)

@RoryAlsop Thanks for the spell-fix on my MiFi question. I hope my comment to your answer made sense.

@Iszi Pretty certain Citizens does

@Iszi No worries - I usually sort spelling as and when I see it. And yes, your comment was grand - made perfect sense, I think it is an unlikely one - but still some possible attacks (due to users not paying attention)

@RoryAlsop Citizens would depend a whole lot on exactly which Citizens you're talking about.

None of the Citizen's banks I've seen are anything more than small town locals.

@RoryAlsop Thanks for the input. Do you think it would be a good question to post here?

@Iszi I think that specific question would be too localized. I wonder how it could be made more generic

I just got done writing a nice little rant to my bank about how I couldn't believe that two-factor authentication was already available for something so relatively trivial as an online gaming account (i.e.: World of Warcraft) and yet they don't seem to offer it!

There were some banking regulations from a few years ago that required all kinds of interesting stuff for online banking

@packs Yeah, a Google for "bank two factor authentication" turned up some articles about a regulation that was supposed to hit in 2006, underneath several papers by Bruce Schneier.

I have a love/hate relationship with Schneier.

Thing is, I think the "regulations" were actually "recommendations" from some watchdog organization. Problem with watchdogs is they're too often all-bark-no-bite.

He is a goddamn brilliant cryptographer.

And..that's..about..it.

@Iszi We also have so many different types of banking institutions that are all regulated differently too.

@packs Yeah, but you'd expect the bigger ones to have their feces in proper alignment.

The credit union I belong to put in place, around that time, lots of weird wonky stuff that was clearly the poor man's two-factor.

@packs Like challenge questions alongside username/password authentication? I heard some have done that.

And pictures and the like.

Along with a captcha.

@packs I can sort of see your point, but at the same time the U.S. does comprise a big portion of any Internet audience.

@packs Yeah, everything still in the "something you know" category it seems.

I wouldn't necessarily call it two factor, since it's still using only 'what you know', but it several layers of disconnected authentication.

@packs Captcha's not another factor for authentication, it's a bot deterrent - and becoming less effective at that every day.

I agree.

@Packs - yeah the Citizens that is a good sized piece of RBS Group

They have various forms of 2 factor

in fact all the banks I deal with have 2 factor at least as an option

Most of the banks I've dealt with have been small town events.

As in, my home town was <10k residents and half the area bank's founders had their grandsons in my high school graduating class.

gotcha

right gotta go - playing a gig tonight, so soundcheck's in an hour. Catch you guys later!

(my other life :-) )

What do you play?

Bah... stuck at work late, waiting for a vulnerability scan to wrap up. :-(

@Iszi Yeah, my puppetmaster was going all wonky, so I ended up being a little late with it.

What do you use for vam?

@packs VAM? Can't say I've heard that term before.

I presume it has something to do with vulnerability scanning?