Why Banks Won't Follow Blizzard And Offer Security Tokens

Image via WikipediaAfter reading this article over at Errata Security and this article over at un-excogitate.org about Blizzard (makers of StarCraft and World of Warcraft) selling security token devices for €6 on their European website. In a nutshell, you have a small device that displays a random six digit number that corresponds to a number on a login server. Coupled with a username and password it meets the standards of two-factor authentication (something you know and something you have). The general sense I get from these two blogs and others I have read on the subject is that banks and other insitutions should be providing similar tokens to their customers. For instance:

Isn't it kind of funny when an online game has better security than most banks?
- Errata Security

If Blizzard is able to offer One Time Password Tokens for a MMORPG platform, then there is no longer a reason why your financial institute doesn’t offer the same.
- un-excogitate.org

I agree with the sentiment but I wanted to start a conversation regarding why you won't be seeing these tokens in the mail from your bank any time soon. The reason most banks, e-commerce sites, and even corporate VPN connections aren't protected by two-factor authentication can be broken down into a few reasons:

• cost: additional cost to customer, shipping, inventory, infrastructure, licensing, staff, overhead, etc.
• complexity: dealing with lost tokens, mistyped numbers causing locked acconts, countless help desk calls, etc. If you are locked out of your WoW account you can't play a game, when you are locked out of your bank account you can't pay bills, transfer funds, check your balance, etc. Simply put, the downside risk of customer convenience is greater than the upside risk of greater levels of security.
• motive: Blizzard is providing these tokens to help secure customers accounts, but also to further secure their future revenue stream and also to combat piracy and cheating, in short, it makes business sense. Banks don't typically suffer very much if a customer account is breached as they very rarely take the hit themselves but instead either insure against the loss (either federally or privately) or simply passing the costs onto customers.

That being said, I do believe that either through public pressure or government mandate eventually consumers will have various security tokens to access sites. Great security, right? Imagine this world: You have a token for your bank, one for your investments, one for work, one for your 401K, one for your medical provider, one for paypal, one for amazon, one for ... you get the point. People complain about having to change passwords every 90 days and having to use special characters, imagine when we start handing them devices to forget at home, lose, break, drop in the toilet, etc.

Perhaps there needs to be an OpenID style system of purchasing a security token that is centrally managed and can be accessed by multiple businesses. Verisign was demonstrating that very technology at the RSA conference this year. But until the technology becomes ubiquitous and cheap keep your passwords strong and your cookies safe.