• Peternorris.net is the site of 19 year old Canadian blogger Peter Norris. He blogs about technology, security, and university life.
    • Peter Norris' Facebook profile

Text Link Ads
« glennwolsey.com a Great Read
Back to School in One Week »

TD Canada Trust Implements Multi-factor Authentication

My main bank, TD Canada Trust, recently implemented a multi-factor authentication system on the online banking site. When you log in from a computer you haven’t used before or perform certain transactions, it will randomly ask you one of 5 security questions (out of about a dozen or more) that you chose earlier. You will then be required to input the right answer to continue to log in.

I personally think this is great. I do a lot of my banking online and anything that makes it more secure is great. Even if it means it takes an extra minute to log in. The only way I think they could improve this is by allowing you to create your own questions. Most of the questions are things an attacker wouldn’t normally look for, but this would make it even more secure. Also I think it should ask you a question everytime you log in.

Ironically, just about two months after they implemented this, they were hit by a phishing attack which targets anybody, whether they are a TD customer or not. The email asks them update their information on a website that looks nothing like the real TD site. I think this would be a good time to remind you that banks and companies that deal with money will probably never contact you by email to “update your information”.

Posted by Peter on Sunday, August 5th, 2007 at 8:10 am.

3 Responses to “TD Canada Trust Implements Multi-factor Authentication”

Great reminder. Banks have been boiling down on security extra hard recently, since the spike in online banking use. I can’t even remember the last time I walked into a bank. :D

Left by ob81 on August 5th, 2007

I don’t think this is true multifactor authentication. Multifactor authentication requires the user to submit a different type of information. The four basic types being: something you know, something you are, something you have, and someone you know. While the security questions they introduced do add a higher level of security, they are still based around the same type of information as the standard password (something you know). If they were to implement something as trippy cool as biometrics (something you are) or a token based system (something you have) then the level of security would theoretically be exponentially increased. (gotta love those adverbs)

Left by Aaron Tait on August 5th, 2007

I know its not true multi-factor authentication, but in a way it is. Multifactor just means more than one factor. Providing a password and then answering a security questions is two ways of proving I am who I am. And its not asked every time, just when i use a new computer. That way, you can steal my password and card number and then log in from your computer without knowing the answers to my questions. This is a step in the right direction, but it needs to be improved upon.

Left by Peter on August 5th, 2007

Something to say?