Kevin's Weblog

In today’s Cryptogram, Bruce Schneier talks about The Failure of Two-Factor Authentication. In it he mentions:

These tokens have been around for at least two decades, but it's only recently that they have gotten mass-market attention. AOL is rolling them out. Some banks are issuing them to customers, and even more are talking about doing it.

Of course, for the same reason that you’re not supposed to share passwords across multiple systems, these corporations aren’t going to let you have just one RSA token that you use everywhere. So, I’m having this nightmare of a key ring full of a dozen or more tokens that I’m supposed to lug around.

I sure hope those organizations read Schneier’s essay and realize that it won’t help.