WebApp Sec mailing list archives

Re: Article - A solution to phishing


From: Saqib.N.Ali () seagate com
Date: Sun, 28 Nov 2004 08:07:17 -0800

My online bank uses a system of picking random numbers from
my password, and asking me to match those numbers with a
drop down box, instead of just typing in the exact password
in the same format at each login.

This "might" prevent against brute force attacks. However if somebody 
already has your password, this login process won't deter him/her from 
accessing your banc account. An easier way to prevent against brute-force 
attacks is to use CAPTCHA ( http://en.wikipedia.org/wiki/Captcha ).

-- 
In Peace,
Saqib Ali
http://tools.tldp.org/search.php <--- Search for Linux HOWTOs


Current thread: