RE: Nordea Sweden shuts Internet banking due to targetedphishing

[Drsolly <drsollyp () drsolly com>]

On Wed, 5 Oct 2005, Larry Seltzer wrote:

> > > That WON'T WORK because it relies on TRAINING USERS, which CANNOT BE DONE.
>
>
> I agree with you completely on this point, but doesn't your two-factor
> authentication idea suffer from the same problem to some extent? It only
> works if the user notices that the phishing site doesn't ask for the code.

If the user doesn't notice, then what happens? The phishing site didn't 
ask for the code, and so he can't log in. If the phishing site does fake a 
log in for the user, then the phisher still doesn't have anything that 
lets him log into the real (bank) site.

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.