PayPal to offer password key fobs to users

TalkBack 7 of 9:

Next »

« Previous

• Thread View
• Flat View

Yeah, and what about Man-In-the-Middle?

PayPal's about two years behind. This solution does no good whatsoever. Man-in-the-Middle attacks work perfectly against key fobs. The phishing site works exactly as it did before, except that instead of just storing your username and password, it connects to PayPal in realtime and passes the Fob info which is obtained on the phishing site. The phishing site essentially acts as a proxy. Granted, they'll only have the 1 session, but how many do you need to transfer money? The answer is 1.

If they were smart, they would have the number on the FOB be correspond to a submdomain, which would be the only place that the user could login at a given time. Let's say the fob shows 1234. Then you could only login by actually TYPING 1234.paypal.com into your browser. It would render stolen passwords useless (since no one with your password would know where to go to login), AND make it impossible for a man-in-the-middle attack to work.

Just my $.25.

Hal

Posted by: hal@...   Posted on: 01/15/07 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now
• Get top-ranked Novell support for Red Hat at 50% less Novell A simplified IT environment isn't just less complex, it's more reliable. ... Download Now
• Virtualization: Architectural Considerations And Other Evaluation Criteria VMware Of the many approaches to x86 systems virtualization available in the ... Download Now