WebApp Sec mailing list archives

Re: Proposal to anti-phishing


From: Florian Weimer <fw () deneb enyo de>
Date: Fri, 14 Jan 2005 23:58:21 +0100

* Rafael San Miguel:

The solution is based in a hardware token that is
delivered to every customer. This token includes the
true certificate that should be presented by the bank
when a customer access his/her account, and a program
that checks if the certificate presented by the
webpage is consistent with the first one. The program
is in read-only memory so that it can't be modified by
anything external to it.

It's acceptable neither to customers nor to banks.  These days,
zero-setup online banking is an absolute must.


Current thread: