Can a Keypad Improve Security?

Posted by Sun on September 23, 2006
Post viewed 281 times, 1 so far today

Advertisements

When I first started online banking in 1998 with then Summit Bank (later bought by Fleet Bank, then acquired by Bank of America), I had to get a software package from the bank and use the software to connect to the bank's database to access my account. It wasn't very easy at that time. Since I could only access my bank account with the software installed in my home computer, there weren't many security issues to worry about, though I couldn't do much with the software other than checking balance and transactions.

Now, online banking becomes much more easier than before, and there are lot of features that I couldn't even think about back in 1998. One of the features I noticed from recent changes at online banks is the way I enter my password (security code, access code, or whatever it's called). Before, I could type in my user name and password and go straight to my account. Now, I have to first enter my user name, then go to the second page to provide my password and that's what made me thinking, because, with the enhanced security as the banks claimed, I need to type in my password using a online keypad instead of my own keyboard.

Why a keypad? Is it more secure than my keyboard?

I have several accounts that require me to use an online keypad to enter my password to get access to my accounts.

The first one is this from INGDirect, a small keypad with 10 keys to input 10 numbers and 10 letters. When I first setup my ING account, the password was a 4-digit PIN. Since I haven't update my password after ING adopted the keypad, I am not sure if letters are allowed in the password now. But this keypad is enough for me.

The second is this from HSBC if I want to go to the Bank-to-Bank transfer section. It's a bigger keypad with 10 numbers and all 26 letters.

Finally, a huge one from TreasuryDirect that has almost all the input keys you can find on your keyboard.

I have to say that I didn't see any added security values of providing online keypads at all. Everything I can find on these keypads are there on my computer keyboard. However, with my keyboard I can choose some special characters if allowed. I also can put capital letters in my password combination. With the keypad, as comprehensive as the one from TreasuryDirect, I am not sure if I can enter capital letters. Or I still have to use the Caps-Lock key from my keyboard to do that. If that's the case, why bother using the keypad. And can't I just use my Backspace to delete what I entered? I don't feel using the Backspace key to clear the characters one-by-one is too much trouble compared to using the Clear key on the keypad to clear them all at once. Even worse for ING and HSBC, a smaller keypad means fewer combinations in passwords. Some websites actually encourage people use special characters in their passwords. With these two, we simply don't have that choice.

By providing a keypad to enter the password, are the banks enhancing the security or limiting it? Or maybe I missed something here.

If you enjoyed reading this post, please consider subscribing to my full RSS feed (What's RSS feed?). Or you can also choose to have free daily updates delivered right to your inbox.

Featured Financial Products

Seeking higher returns for your cash? Take a look at the latest interest rates from leading online banks and find out where to get the most for your money.
Earn up to 5% cash back from these cash back credit cards while shopping at gas stations, grocery stores, or online.