New phishing attack uses real ID hooks

TalkBack 7 of 8:: Next »; « Previous

Thread View
Flat View

Banks respond by loading consumers down with "One Time Password" Devices: What's really disheartening is that the banks' security "experts," acting through the Financial Services Technology Consortium, appear poised to standardize on a One Time Password (OTP)device approach to implementing strong authentication... With OTP, *each* online site, issues *each* user in a household a key-fob sized token with a 6 digit psuedo-random number that changes every 60 seconds. Two accounts, two tokens. Ten accounts, ten tokens. Two people in the house, double the number of tokens. Got your oversized key ring ready?

PLUS, as the article says, keystroke loggeers are being increasingly used to get credentials. All that an OTP device does is require that they relay the OTP code when you type it to them in real time, so they can use it right away. Automated scripts can do their part of the theft, so don't count on them getting overwhelmed.

It seems that the original FDIC and FSTC reports on countering phishing had recommended other options besides OTP tokens, which would have resulted in greater user convenience, and better security...

Isn't there an authentication device that can be shared among as many household users and online sites as desired, without having to rely on a third-party authorization service, and without requiring web site operators to know about one another? Ideally, such a device would be built in to laptops and keyboards, and would not require a user to remember or carry anything...

Oh wait... what's IBM up to with their T42, T43 and X41 laptops? Oh, and look... Toshiba, Dell, Gateway, Micron and Fujitsu are doing it too. Couldn't *that* device be leveraged to achieve stronger authentication that doesn't make me carry a bag o' tokens?; Posted by: SecurityThroughObscurity Posted on: 05/16/05 You are currently: a Guest | Members login | Terms of Use