Discussion on:

How DBS Bank implements two-factor authentication

The two-way authentication is not new to security industry but don't understant why many international banks are still not able to implement this. Many European banks strictly follow two-way authentication but there are many banks and organizations missing this!

Recently I have seen voice biometrics gaining traction, voice will be very difficult to mimic, combine that with 2fa. It however depends on the strength of the biometric system.

With a Digipass (specialized pocket calculator), the customer would not have to wait for an email from its bank before transferring money to a new beneficiary. European banks for this case ask the client to input additional details directly thru the digipass machine. Similarly, if the amount to be transferred is over $2000,00 , again as a precaution: the bank asks to key in additional details directly into the digipass. As you can see, no idle time is spent waiting for an email (which may never arrived if sent to the wrong address).

I don't \understand why DBS sends one-time passwords sometimes to our second factor tokens and sometimes to our mobile phone SMS.
This makes it very inconvenient for travellers, because it means that they will have to carry both their tokens as well as their mobile phones with them wherever they go. What about those whose registered mobile does not have roaming facility in a particular country? They will be completely cut off from using DBS facility too.
I strongly suggest that DBS allows the user to choose between tokens and mobile SMS, just like what OCBC and Stanchart do. So, in this respect DBS is still primitive compared to other banks. DBS should do away with sending one-time passwords to mobiles for people who travel to a country that does not have roaming facilities for our Singapore SIMcards.

As an IT professional, I don't see how these are different from any major banks in the world. As a bank client, these are bottom line security I would look for before banking in.

It's nice to see another company giving users the perfect balance between security and user experience by implementing 2FA which allows us to telesign into our accounts. I know some will claim this make things more complicated, but the slight inconvenience each time you log in is worth the confidence of knowing your info is secure. I'm hoping that more companies start to offer this awesome functionality. This should be a prerequisite to any system that wants to promote itself as being secure.