Re: limits of end-user "testing"

[Javier Fernandez-Sanguino <jfernandez () germinus com>]

Kurt Seifried wrote:

> > a) have two factor transaction signing (SMS or token based) to  
> > prevent unauthorized transfers via phishing
>
>
> This doesn't prevent phishing per se. I can setup a phishing site that 
> acts as a man in the middle proxy to the bank's site. You log into my 
> site, I log into the bank's site, get a challenge, send the number to 
> you the victim, you reply and I forward it to the bank, voila.

It doesn't prevent phishing, but it raises the bar quite a bit. Notice 
that a MITM for a bank needs to be crafted _for_that_bank in 
particular, compare that against the current status in which most 
phishing attacks are just based off the same template, with the same 
tools, that do not have to know of the bank's application logic but 
just mirror its aspect.

Granted, once you have C/R systems everywhere attackers will focus on 
it and, "attacks always get easier, they never get worse" (Scheneier 
dixit). That means that you will eventually have phishing toolkits 
too. In the meantime, however, attackers will still go for easier 
targets (banks with passwords that can be stored either through fake 
sites or trojans). So banks can expect fraud to go down a bit.


Just my 2c

Javier