The recent flurry of publicity about the low level of security used by banks for their internet banking seems to have been triggered by the police apparently discovering keyloggers and making a fuss about them.
Goodo! I say. The push for increasing the security is a good thing, but the banks are the ones that have to take responsibility for ensuring it happens. Calls for the government to legislate or somehow force it to happen are misguided. (I find it amusing that it seems to be the market-economy accolites who are making these calls for regulation: surely the market should drive the need.)
Two-factor authentication is a splendid move, but the focus seems to be on the use of cellphone texting for transmitting a transaction pin. I hope the banks are not so *stupid* as to use only this as a means for implimenting stronger systems. The European banks have been using TANs (Transaction Authentication Numbers) for some time with considerable acceptance.
A simple system of allowing the client to *choose* the second authentication vector (cellphone, or the list of one-time numbers in their wallet) for each transaction would be sufficient.
I find internet banking sites can be slow enough, without adding in the need to wait (what?) up to 3 minutes for a text message to come through so you an complete a transaction.