one, passwords are inherantly a weak form of protection, hence the need for a token.

Second, your token is only as good as it's protection. There are two attacks that tokens are vulnerable too:
one is generating the token (the OATH algorithm used is well documented)

and the other is stealing the token.

Neither of these two protections will protect you against man in the middle or phishing attacks.

What if you REFUSE to use PayPal? As in, I will no longer shop on EBay if it means I HAVE to use PayPal?

PayPal is not a bank, and it's not a credit card company. It does not have to follow any of the established US Banking rules & regs. They are a totally fly-by-night company that exists for one reason, to get their hands on your money.

@pjorg: For that matter, how do you log onto Pay Pal from your iPhone? 30 seconds seems like a small window for a system that doesn't support multitasking.

It does work. And it's also worth noting that somehow, when you open the VIP app, it always gives you 30 seconds. So each time you have 30 seconds to remember the number, exit, open your eBay/PayPal app, and log in. Not too bad.

Too True.
Forget Paypal and Ebay!

and it works

It is true that confirming who you are is now based on two factors: what you know (your password) and what you have (your keyfob). However, such systems are still open to attack by sufficiently clever and motivated attackers.

The general attack is called man-in-the-middle (please forgive the non-PCness for the alliteration). By tricking a user to go to the attacker's site the attacker can take the user's password and keyfob password, send it to the real E-Bay and then send the results back to the user.

This is why it pays to check for the little golden key at the bottom of your browser screen.

...the big problem with this is that you're still dealing with the eBay/PayPal hellhole of eternal suffering. There is not the slightest bit of trustworthiness in that infernal conflagration of a corporation.

@JGBrock: This would assume however that the person trying to hack into your PayPal/eBay account was also trying to hack into your iPhone at the same exact time. This would require the hacker to know that you had an iPhone and to be in close enough proximity to your phone so that he could somehow intercept any data that is being transmitted.

It may not be as foolproof or as secure as the fob, but it will stop probably 99.99% of the hackers, and the remaining 0.01% would need to have so many things going right for them that it is highly unlikely that they would be able to gain access.

At least with the keyfob you can be looking at both at the same time...

My question is, will an application be made for WoW just like this so everyone can have the same level of security?

Authenticator FAQ [us.blizzard.com]

My wife uses this sort of thing to access patient records from home. Due to health records privacy laws (HIPA...the reason we have to fill a new form at the doctor/dentist yearly).

Seems to me that this would not be a secure as the keyfob. The keyfob has no radio and can not be hacked. It has to be in your physical possesion.

Also, would it not be possible to figure out what parameters the software is gathering from the phone and plug these into a program running elsewhere? Again, not possible with the fob since it using a code associated with that chip.

Improved Paypal security is great!!!!
Unless of course Paypal is the one stealing your money.

It makes it hard for people without physical access to your stuff, to break in.

For me, I use this on PayPal, but not eBay, because I probably login to eBay 5 times more than PayPal, and it's not worth the hassle of pulling a code every one of those times.

If you've lost it, you'll have to verify you're the account owner and then disable the security key from your account.

@juddcarlos2003:
It's a security tool. In addition to your Username and password, you would also enter the code on the keyfob. It generates new codes every minute or so, making it nearly impossible for someone to misuse your identity.

If all the credit card companies would require something like this, Identity theft would come to a screeching halt.

Is there some longer confirmation process that I can use to log in anyway? Or am I SOL?