WebApp Sec mailing list archives
Proposal to anti-phishing
From: Rafael San Miguel <smcsoc () yahoo es>
Date: Wed, 12 Jan 2005 10:37:09 +0100 (CET)
Hi all, I am currently working on a security design that involves an innovative strategy to combat phishing. I have something in mind that seems to work allright. The solution is based in a hardware token that is delivered to every customer. This token includes the true certificate that should be presented by the bank when a customer access his/her account, and a program that checks if the certificate presented by the webpage is consistent with the first one. The program is in read-only memory so that it can't be modified by anything external to it. The customer will not be able to access his/her account if the token is not plugged in, or if the check fails. Note that it is the token who sends credentials, not the client. Also, the token is PIN-protected to prevent unauthorized use. I don't see any obvious disadvantages to this solution. Hope this helps other people researching for anti-phishing techniques. Greetings, Rafael San Miguel Carrasco ------------------------------- Rafael San Miguel Carrasco Consultor Técnico rafael.sanmiguel () dvc es + 34 660 856 647 + 34 902 464 546 Davinci Consulting - www.dvc.es Oficina Madrid - Parque empresarial Alvento Via de los Poblados 1 Edificio A 6ª planta 28033 Madrid -------------------------------
Current thread:
- Proposal to anti-phishing Rafael San Miguel (Jan 14)
- RE: Proposal to anti-phishing Don Tuer (Jan 14)
- Re: Proposal to anti-phishing Rishi Pande (Jan 15)
- RE: Proposal to anti-phishing RSnake (Jan 15)
- RE: Proposal to anti-phishing Lyal Collins (Jan 16)
- RE: Proposal to anti-phishing Frank Knobbe (Jan 19)
- RE: Proposal to anti-phishing Lyal Collins (Jan 19)
- RE: Proposal to anti-phishing Sam Koh (Jan 23)
- Re: Proposal to anti-phishing Rogan Dawes (Jan 19)
- RE: Proposal to anti-phishing Don Tuer (Jan 14)
- RE: Proposal to anti-phishing WebAppSecurity [Technicalinfo.net] (Jan 15)
- Re: Proposal to anti-phishing Rogan Dawes (Jan 15)