How PayPal Will Fight Phishing and Password Cracking

I've done a couple of posts lately about password cracking and online security, and in your emails and comments I can hear your frustration: What is being done about this online epidemic?

Well, PayPal (one of the most heavily-targeted financial websites) is finally taking steps in the right direction, with a hardware security key that makes cracking your account next to impossible.

Often called security tokens, a security key is a small piece of hardware that's designed to be carried with you at all times (typically on a keychain). The device does nothing except generate a different six-digit number every 30 seconds. There's no way to predict the number at any given time, which is generated by an algorithm on both the key itself and by a matching algorithm on PayPal's servers.

Now here's the trick: If you have the security key (pictured), when you visit paypal.com you're asked for the usual user name and password as well as the six digits displaying on the security key at the moment you login. Assuming your password is also good, if the six digits you type match those that PayPal has generated, you're in.

Many businesses already use these keys for remote access, so you might be familiar with how they work. This is exactly the same premise, providing an extra layer of security that only the bearer of the security token knows. If you want to obtain the PayPal Security Key, it will be available later this year (an exact date is undetermined), but you can keep tabs on it here. The keys are optional and will cost $5. Infoworld has more details.

I have to say this is great news, and I'll probably sign up since I get several PayPal phishing emails every day, but security keys don't scale. If I have even six critical online accounts, that's a lot of hunks of plastic on my keychain. At the same time, a centralized version of this technology probably wouldn't work.

For now, though, this is a step in the right direction. Anyone have any better ideas for the future?