IB Secure Device

Quote from frostengine:

I believe this is a big mistake on the part of IB to require API users to have to manually log in. There should be an opt out option... At the very least when you create a second user name for your individual account your able to specify what that account can do. Such as funds management and trading.... If you specify a second user name for your account to only do trading, you should be able to allow that account to login without this option. Having a fully automated system and then being required to login DAILY for it to work because the TWS turns itself off once a day..... this removes a lot of the convience you have with automated systems and is a big mistake.

I work for a network security company and we have designed several multi-factor authentication schemes for clients. There are other ways to produce multi-factor authentication without causing this big of an invonvience to select users of IB. One of the primary reasons I switched to IB was to have a fully automatic trading machine. This new "security" measure effectively takes that away from me. IB promotes the use of trading bots and is one of the best brokers to be if that is your goal. Why make this requirement which would undoubtly turn people away?
More...

perhaps for the API users. if you choose to opt out you are forced to provide an IP range which IB only allows you to connect on. iv been hoping for this feature since i only trade from a single IP address.
 
Walter,

Good point... there are PLENTY of ways to provide a second form of identification. This should not be the only route IB uses. This is going to really complicate things for api users.
 
Quote from frostengine:

Walter,

Good point... there are PLENTY of ways to provide a second form of identification. This should not be the only route IB uses. This is going to really complicate things for api users.
More...

from the sounds of it they are offering a few different devices, up to 150$ deposit? perhaps they are going to offer a hardware dongle or something along those lines.
 
This decision is absolutely brilliant.

While IB could have done something to allow for automated logins (generate a public/private key, have an x509 cert signed, etc), the complexity for the average customer would have been phenomenal.

Forget about your firewall, anti-virus software, etc. there are hundreds of new vulnerabilities discovered every day. (Security Focus for just one list--look how many new were discovered just today)

Just last week, a new trojan was discovered that had been in the wild for 6 months. No antivirus software at all caught it. It captured every username, password, account number and shipped it off to a server in Russia to be sold to the highest bidder.

Security is no longer a dalliance that you can "do without". When seatbelts were first mandated, people argued they "cramped their style". Arguing against strong security is equivalent to arguing against seatbelts.
 
I have used the current secure keyfob since they've been offered. They are annoying (tiny buttons!!), and sometimes the places on the website that require their use don't work after you enter the generated password (the website responds with a blank page and nothing else).

The thing I'm very concerned about is losing the keyfob (or if the house burns down and the keyfob goes with it). IB should offer additional, identical keyfobs as an option. I would keep them in separate locations like I do with car keys.
 
I am making NO argument against strong security. Working for a network security company I know all too well the attacks that are out there. I am only making an argument about the way they are implementing it. There are ways to do this without causing problems for API users. Especially for API users who will always be logging in from the same box and same ip address. As for as my manual trading goes, I think this is a great idea and I have no complaints to requiring this to login... My complaint is strickly as it relates to auto trading with the API
 
Quote from walterjennings:

if someone records a screenshot of the 'non standard digits/characters pad, and sees where you clicked on that pad and in what order... how would they not know your pin? maybe i dont understand the concept correctly. the pin doesn't change correct?
More...

Recording and transmitting screenshots could presents another level of difficulty for the hacker, but assuming they can do it, then yes.

This is why a device/method of password or key distribution/generation totally external to the computer system is the best solution.
 
Since the new secure token will be a requirement, I hope IB takes the opportunity to fix a major annoyance with the current system. Right now, if you use a part of the website that requires the token challenge, you need to enter it. If, in the same session, you go to another area in the website that requires a token challenge, you have to do this again! Very annoying! You should only need to do it once per login.
 
You must log in or register to reply here.
Back
Top