Comment by xorcist
5 days ago
I don't know where you live or with whom you bank, but there were plenty of hardware tokens for banking for almost two decades until phone apps took over. They are not likely to return. Managing many hardware tokens is a big undertaking and people regularly forget them or destroy them. Phones are so much easier and people generally don't want to carry extra devices. They don't even want to carry comparably tiny credit cards given the choice.
No no, we don't want tokens. We don't want that at all.
In the United States, users of Chase are already using FIDO2 to access their Chase accounts with hardware keys often priced at $15 or $20 made by a diverse set of 3rd party vendors such as Yubico, which has the same cryptography-grounded effects I suggested above. One hardware key can store private keys for several remote sites, this is a basic part of FIDO2.
Before Chase did this, I directly kvetched at Chase on LinkedIn pointing out that many smaller banks had already been securing access to accounts with FIDO2.
Trezor and Yubikey 5C devices happen to also do FIDO2, but the ultimate answer that provides end-to-end cryptography, meaning the cryptographic pieces reach all the way to the record matching the actual contents of the transaction stored at the bank, uses a different format. The legacy tokens never provided end-to-end cryptography, and from a security perspective are as crummy and vulnerable to MITM as OTP/TOTP.
As far as holding onto hardware keys, users don't lose hardware keys/wallets when those are attached to a keychain and the users are instructed to attach to add it to their general car/house keys. Attached to general car/house keys/fobs, hardware keys survive user-chaos at a much better rate than smartphones do. Other security-focused IT pros/execs have reported the same.
The key difference between those hardware tokens and hardware keys/wallets that do OpenPGP, or PIV, or the underlying cryptograpy functionality of "Bitcoin wallet", is they
and