Re: Proposal to anti-phishing

[Rogan Dawes <discard () dawes za net>]

Lyal Collins wrote:
> To eapnd on this, there is nothing the stop the phisher capturing the entire
> session (i.e MITM tunneling), even using a valid OTP token to logon, and
> even a second OTP token to 'authenticate' a transaciton.
> With tunneling the entire session, the attacker can easily present the user
> with screens saying "transfer $200 to mum" while telling the banking site to
> 'transfer $1000 to joe () hacking site.somewhere"
>
>
> Lyal

Exactly. And this is another reason to use SSL client certificates. 
Because they are invulnerable (for large numbers of invulnerable ;-) to 
MITM attacks.

Rogan
--
Rogan Dawes

*ALL* messages to discard () dawes za net will be dropped, and added
to my blacklist. Please respond to "lists AT dawes DOT za DOT net"