Your key to PayPal

Kudos to PayPal.  They're the first of the major online services to offer a security key for all of their users.  You know, one of those things just like an RSA SecurID key fob (which it may be, re-branded) that show a different 6 digit number every 30 seconds that the user enters at the web site to prove their identity.  They've attached a $5 price tag to the device, but I'm guessing that's just a way to prevent every customer from ordering one unless the customer is really going to use the device.

What does this accomplish for PayPal?  It gives them two-factor authentication.  The forms of identification are generally agreed to be something you know, something you have and something you are.  Occasionally we can add 'somewhere you are' to this, but that doesn't really apply to e-commerce.  The use of password is something you know, which is a good start, but passwords are often easy to guess and only using one form of identification leaves you open to a wide variety of issues.  By introducing a second form of identification, PayPal has placed themselves far above most of their competition and is showing a commitment to security.

This doesn't prevent man-in-the-middle attacks, but it takes a huge bite out of password guessing attacks and stolen passwords.  Your roommate will no longer be able to walk up to your computer and use your PayPal account because you cached your password.  Not that you'd ever do that, but if you did ... 

I think we'll be seeing a lot more of this over the next few years.  The only problem will be when you've got four or five (or more) of these keys and have to carry them around all the time.  I think we'll see these security keys compressed until they get to be the same size and form factor as your credit cards, maybe even integrated into your credit card.  You'll pull your PayPal-branded credit card out of your pocket and enter in the latest code flashing on the paper thin screen.   We're not there yet, but I think we'll see this within a few years.  I look forward to that day, because then we can do away with the security codes on the back of the card (properly called a CVV2 number) and instead use the same technology PayPal is using.  When we can have this built into our credit cards, we'll see a huge drop off in fraud.  Until the hackers break that too.