SECOND PASSWORD OR TWO FACTOR AUTHENTICATION DOB, PAN, PHONE NUMBER, MOTHERS MAIDAN NAME, …. ETC. ARE NOT PROPER. IT MUST BE SECRET ND SELF CREATED.

1.

What is a two factor authentication?

A.

It is a security feature where an customer will need to satisfy 2 authentication criteria in order to login to a system. To access a system, the user should satisfy 2 out the given 3 criteria:

• Something the user knows (Eg. ATM pin)
• Something the user has (Eg. ATM card)
• Something the user is (Fingerprint)

Kotak Securities has opted for a & b where ‘something the user knows’ is your password and ‘something the user has’ is your security key or access code.

2.

Why do I need two factor authentication for online trading?

A.

In compliance with the new SEBI circular on increasing the security for your Stock trading account, we have introduced the 2-factor authentication process. This will give another security layer to your trading account.

3.

For whom this two factor authentication is applicable?

A.

This feature is applicable to all the online customers of Kotak Securities.

4.

What will be the 2 factors authentication that Kotak Securities will use?

A.

Kotak Securities will ask you for a security key or an access code when you try to login to your trading account. Access code will be applicable to only those customers who do not have a security key.

5.

What is an Access code?

A.

An Access code is a four digit number which you will required along with your user id and password at the time of login.

6.

if I have a security key, do I need Access code?

A.

No, Security key itself works as a second authentication to the online trading customers.

7.

I have a security key but I have not activated it. Can I use access code to login?

A.

No, if you have a security key that you haven’t activated, then you need to activate it to login. You cannot use access code if you have a security key.

8.

How can I use the security key?

A.

Perform the below steps to use your security key :

• Login to www.kotaksecurities.com and go to the login page
• Click on ‘Activate Security Key’ and enter you User-ID and Password
• Follow the steps to activate your security key
• After activating the security key, log in to KEAT Pro X / Mobile Stock Trader / Website with your User ID, Password and Security Key
• Press the button on your Security Key to get the digital Security Key access code
• Enter this number in the Security Key field  

9.

Can I trade without an Access Code or Security Key?

A.

No, for every login you need to have a password and a security key or an access code.

10.

How can I use the access code?

A.

• Login to www.kotaksecurities.com  / KeatProX / MST Enter your User ID and Password
• Click on ‘Generate an Access code’. The 6 digit access code will be sent to your registered mobile number and E-mail address
• Enter the access code and click ‘Submit’
• This access code will be valid till 23:59:59 PM on that day. You can use the same access code to log in till that time

11.

How can I update my contact details?

A.

• Go to www.kotaksecurities.com
• Login with your User ID and password
• Click on ‘My Account’
• Click ‘Update My Profile’
• Update your mobile number and E-mail Id and click ‘CONFIRM’

12.

Are NRIs also required to have access code?

A.

No, the NRI online trading customers will have to use the security key to login to their accounts.

13.

How can I get security key as an NRI customer?

A.

The security key will be send to you via post on your registered address with us.

TWO FACTOR AUTHENTICATION

Copyright

The information contained herein may not be copied, retransmitted, disseminated, distributed, sold, resold, leased, rented, licensed, sublicensed, altered, modified, adapted, or stored for subsequent use for any such purpose, in whole or in part, in any form or manner or by any means whatsoever, to or for any person or entity, including the purchaser, without DotEx International Ltd. express prior written consent.

 Introduction

SEBI has mandated 2 Factor Authentication from the next financial year with reference to SEBI circular no CIR/MRD/DP/ 8 /2011 dated June 30, 2011 To comply with this mandate NOW has implemented 2 Factor Authentication in the form of image and question & answer.

Login Procedure

Steps for setting 2FA

(a)Enter Member ID & User ID

Top 4 misconceptions about Two Factor Authentication

By: Rakesh Thatha, Co-Founder and CTO at ArrayShield
RBI and SEBI guidelines over last few years have mandated the use of two factor authentications for online banking and trading transactions.
SEBI guideline last year for broking community says the following “Two-factor authentication for login session may be implemented for all orders emanating using Internet Protocol” [Circular number: CIR/MRD/DP/ 8 /2011]
RBI guideline last year for Urban co-operative banks says the following “In view of the proliferation of cyber attacks and their potential consequences, UCBs should implement two-factor authentication for fund transfers through internet banking” [UBD.BPD.(SCB)Cir No. 1/09.18.300/2011-12]
In the above RBI Circular there are some interesting points to be noted regarding Two Factor Authentication:

• Properly designed and implemented multifactor authentication methods are more reliable and stronger fraud deterrents and are more difficult to compromise. The principal objectives of two-factor authentication are to protect the confidentiality of customer account data and transaction details as well as enhance confidence in internet banking by combating various cyber attack mechanisms like phishing, key logging, spyware/malware and other internet based frauds targeted at banks and their customers.
• By definition true multifactor authentication requires the use of solutions from two or more of the three categories of factors. Using multiple solutions from the same category at different points in the process may be part of a layered security or other compensating control approach, but it would not constitute a true multifactor authentication. [The standard categories of factors include following: 1. - Something the user knows (e.g., password, PIN, pattern); 2.  Something the user has (e.g., ATM card, smart card, grid card); and 3.  Something the user is (e.g., biometric characteristic, such as a fingerprint).

But in reality there are some common misconceptions that consumers, enterprises typically get into while using, implementing and evaluating two factor authentication technologies. Let us look at top four of those misconceptions:

1. Using two passwords considered as two-factor authentication?

• No. As noted in the above RBI circular and also commonly accepted by security experts world-wide, two passwords come under the same category of factors i.e. something the user knows. Hence using two passwords will not be considered two-factor authentication and is still prone to multiple attacks that can compromise a single password based authentication solution.

2. Using password along with user’s date of birth/PAN number etc. considered as two-factor authentication?

• No. Even information like user’s date-of-birth, PAN number comes under the same category of factor i.e. something the user knows. In fact it is easier for hacker to crack the user’s date of birth/PAN number unlike password which is known only to the user. Hence this approach cannot be considered as two-factor authentication and prone to multiple attacks.

3. Using password along with a Question and Answer based authentication approach considered as two-factor authentication?

• No. Even Question and Answer based authentication approach which involves the end user answering questions like “Which floor does he live?” etc come under the same category of factor i.e. something the user knows. Hence this approach cannot be considered as two-factor authentication though provides better security than using two passwords based authentication approach.

4. Using virtual key-board considered as two-factor authentication?

• No. Virtual key-board is just a different key inputting mechanism for entering the password.  Though it protects against key loggers, it can be compromised using advanced version of key loggers that have screen logging capability. As virtual keyboard doesn’t have any second factor of authentication it is also not considered two factor authentications.