WebApp Sec mailing list archives
RE: Proposal to anti-phishing
From: ACMurray () cmp com
Date: Fri, 14 Jan 2005 11:00:12 -0800
Hi Rafael, AOL announced a similar offer a few months ago called PassCode. They send an RSA SecurID token to customers who sign up for the service (I think they're charging 10 bucks for the token and $1.95 a month for the service). I haven't heard how much uptake they've gotten. While two-factor authentication is great, if every bank, ISP, and e-commerce provider goes this route, customers are going to drown in little plastic gizmos, have to remember more passwords/PINs, and go through the headache of dealing with lost/broken tokens. It's also not going to get you off the hook of designing your Web apps to withstand cross site scripting, SQL injection, etc. etc. etc. That said, anything that can prevent consumers from being victimized by scammers is a good thing. Best, Andrew Conry-Murray Technology Editor Network Magazine acmurray () cmp com (415) 947-6342 ***************************************************************** INNOVATIONS 2005 Nominate your product now for Network Magazine's Innovations Award. More details can be found at: http://www.networkmagazine.com/innovation-awards/ ***************************************************************** "Don Tuer" <don.tuer () cgi co To: "'Rafael San Miguel'" <smcsoc () yahoo es>, <webappsec () securityfocus com> m> cc: <Enrique.Diez () dvc es> bcc: 01/14/2005 07:28 Subject: RE: Proposal to anti-phishing AM Two phased authentication is good for security but some obvious disadvantages include: - Cost of hardware tokens - Cost of distribution - Cost of managing hardware - Complexity and user training Also will the user need to return their token for replacement if they forget the PIN? Thanks Don -----Original Message----- From: Rafael San Miguel [mailto:smcsoc () yahoo es] Sent: Wednesday, January 12, 2005 4:37 AM To: webappsec () securityfocus com Cc: Enrique.Diez () dvc es Subject: Proposal to anti-phishing Hi all, I am currently working on a security design that involves an innovative strategy to combat phishing. I have something in mind that seems to work allright. The solution is based in a hardware token that is delivered to every customer. This token includes the true certificate that should be presented by the bank when a customer access his/her account, and a program that checks if the certificate presented by the webpage is consistent with the first one. The program is in read-only memory so that it can't be modified by anything external to it. The customer will not be able to access his/her account if the token is not plugged in, or if the check fails. Note that it is the token who sends credentials, not the client. Also, the token is PIN-protected to prevent unauthorized use. I don't see any obvious disadvantages to this solution. Hope this helps other people researching for anti-phishing techniques. Greetings, Rafael San Miguel Carrasco ------------------------------- Rafael San Miguel Carrasco Consultor Técnico rafael.sanmiguel () dvc es + 34 660 856 647 + 34 902 464 546 Davinci Consulting - www.dvc.es Oficina Madrid - Parque empresarial Alvento Via de los Poblados 1 Edificio A 6ª planta 28033 Madrid -------------------------------
Current thread:
- RE: Proposal to anti-phishing, (continued)
- RE: Proposal to anti-phishing Lyal Collins (Jan 24)
- RE: Proposal to anti-phishing lists (Jan 24)
- Re: Proposal to anti-phishing Kurt Seifried (Jan 24)
- Re: Proposal to anti-phishing Rogan Dawes (Jan 27)
- Re: Proposal to anti-phishing Moksha Faced (Jan 27)
- Re: Proposal to anti-phishing Jimi Thompson (Jan 23)
- RE: Proposal to anti-phishing Lyal Collins (Jan 24)
- Re: Proposal to anti-phishing Robert Hajime Lanning (Jan 24)
- Re: Proposal to anti-phishing Florian Weimer (Jan 19)
- Re: Proposal to anti-phishing exon (Jan 23)
- Re: Proposal to anti-phishing Rogan Dawes (Jan 23)
- Re: Proposal to anti-phishing Michael Silk (Jan 23)
- Re: Proposal to anti-phishing Rogan Dawes (Jan 23)
- Re: Proposal to anti-phishing Michael Silk (Jan 23)
- Re: Proposal to anti-phishing Rogan Dawes (Jan 23)