Full Disclosure mailing list archives
Re: Bank of America SiteKeys ineffective?
From: "Mary Landesman" <mlande () bellsouth net>
Date: Fri, 27 May 2005 12:30:09 -0400
From my read of the news.com article and admittedly limited knowledge of
SiteKeys, it does not seem to me their intent is to make sure the user knows they are at a legitimate BOA page. Rather, it seems to me the intent is to ensure that if Betty Boop logs into her BOA account, that she's doing so from a pre-authorized Betty Boop specified computer. And if she's not, then the use of SiteKeys will make Betty Boop jump through several authentication hoops before she is allowed access. So if Betty Boop falls for a phish and compromises her account logon details, the attacker would (presumably) have a more difficult time exploiting those logon details. Regards, -- Mary ----- Original Message ----- From: "Mike N" <niceman () att net> To: <full-disclosure () lists grok org uk> Sent: Friday, May 27, 2005 7:32 AM Subject: [Full-disclosure] Bank of America SiteKeys ineffective? http://news.com.com/Bank+of+America+takes+on+cyberscams/2100-1029_3-5722035.html?tag=nefd.top While I applaud Bank of America for being the first to take serious steps to combat phishing, SiteKey only elimintes one class of attack - the simple web site that masquerades as the real site. From what I can see in the article, SiteKey does not make use of digital certificates to identify the user. Therefore it does nothing to eliminte the class of more sophisticated man-in-the-middle attacks already in use which make use of DNS poisoning to take users to the wrong site. - For this case the browser will cough up the cookie to the phisher site, which they can pass on to the BofA site. This will trigger the BofA site to send back the image and phrase to the user via the Phisher site. The user will enter the login and password; being none the wiser until it fails or he is taken to the Phisher login action of choice. Bottom line: The only way be reasonably sure you are at your bank's site is to go to a secure login page and examine the certificate to be verify it's issued by a reputable certificate issuer to your bank in your bank's locality. If your bank uses a discount certificate issuer that you don't recognize, don't trust them and get your bank to go with the real thing. And better yet, bookmark the secure page to minimize chances of a typo taking you to a secure type-alike site. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Bank of America SiteKeys ineffective? Mike N (May 27)
- Re: Bank of America SiteKeys ineffective? Mary Landesman (May 27)
- Re: Bank of America SiteKeys ineffective? Mike N (May 27)
- Re: Bank of America SiteKeys ineffective? Mary Landesman (May 27)
- Re: Bank of America SiteKeys ineffective? Mike N (May 27)
- Re: Bank of America SiteKeys ineffective? Mary Landesman (May 27)