Re: [WEB SECURITY] SSL does not = a secure website

[michaelslists () gmail com]

I think you could still replay the old details, even if all you had to
do was modify a "authorisationMethod=a" to "authorisationMethod=b". I
don't know for sure though ...

-- Michael

On 3/29/06, Jeremy Bellwood <Jeremy.Bellwood () serengetilaw com> wrote:
> I think ING Direct has done a pretty good job at evaluating the security concerns making it difficult for keyloggers.
>
> The question used for "Step 2" changes each page refresh.  They also have a dynamically generated 10-key pad used in 
> "Step 3" where a user either types the letters instead of the numbers OR click on the numbers.
>
> Since both "Step 2" and "Step 3" are dynamically generated with each page refresh I think it makes it significantly 
> more difficult get all the information needed to impersonate a valid user.
>
> -Jeremy
>
> ________________________________
>
> From: michaelslists () gmail com [mailto:michaelslists () gmail com]
> Sent: Tue 3/28/2006 5:54 PM
> To: Mark Mcdonald
> Cc: James Strassburg; Sebastien Deleersnyder; Web Security; webappsec () securityfocus com
> Subject: Re: [WEB SECURITY] SSL does not = a secure website
>
>
>
> I hate this thing with a passion. I actually have to use it.
>
> God help anyone that needs to use it in an office environment, anyone
> walking past your "cube" could _easily_ see what password you are
> typing in.
>
> -- Michael
>
> On 3/29/06, Mark Mcdonald <mmcdonald () staff iinet net au> wrote:
> > Westpac Bank in Australia has recently put an on-screen keyboard up.
> > Check it out here:
> >
> > https://online.westpac.com.au/esis/Login/SrvPage
> >
> >
> >
> > -----Original Message-----
> > From: James Strassburg [mailto:JStrassburg () directs com]
> > Sent: Wednesday, 29 March 2006 11:16 AM
> > To: Sebastien Deleersnyder; Web Security; webappsec () securityfocus com
> > Subject: RE: [WEB SECURITY] SSL does not = a secure website
> >
> > There are additional countermeasures that a web application can
> > implement.  For example, the app could have the user enter his/her
> > password by clicking an onscreen keyboard or ask the user for random
> > characters from their password (enter the 2nd, 4th and 10th character of
> > your password).  I should state that while I've read about these I don't
> > know of a web application that makes use of them.
> >
> > James Strassburg
> >
> > ________________________________
> >
> > From: Ryan Barnett [mailto:rcbarnett () gmail com]
> > Sent: Tuesday, March 28, 2006 8:10 AM
> > To: Sebastien Deleersnyder
> > Cc: Web Security; webappsec () securityfocus com
> > Subject: Re: [WEB SECURITY] SSL does not = a secure website
> >
> >
> >
> > On 3/28/06, Sebastien Deleersnyder <sebastien.deleersnyder () ascure com>
> > wrote:
> >
> > Their is nothing that a website can do to prevent keyloggers on the
> > user's machine.
> >
> > Well, now that I think about it, that is not entirely true...  Websites
> > could front-end their web apps with applications such as Sygate (
> > http://www.symantec.com/Products/enterprise?c=prodinfo&refId=1302
> > <http://www.symantec.com/Products/enterprise?c=prodinfo&refId=1302> )
> > which can check the user's computer for some forms of malware (including
> > keyloggers) and then place the user into a Java virtual machine to help
> > protect user credentials.
> >
> >
> > ---------------------------------------------------------------------
> > The Web Security Mailing List
> > http://www.webappsec.org/lists/websecurity/
> >
> > The Web Security Mailing List Archives
> > http://www.webappsec.org/lists/websecurity/archive/
> >
> >
> > -------------------------------------------------------------------------
> > This List Sponsored by: SpiDynamics
> >
> > ALERT: "How A Hacker Launches A Web Application Attack!"
> > Step-by-Step - SPI Dynamics White Paper
> > Learn how to defend against Web Application Attacks with real-world
> > examples of recent hacking methods such as: SQL Injection, Cross Site
> > Scripting and Parameter Manipulation
> >
> > https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl
> > --------------------------------------------------------------------------
>
> ---------------------------------------------------------------------
> The Web Security Mailing List
> http://www.webappsec.org/lists/websecurity/
>
> The Web Security Mailing List Archives
> http://www.webappsec.org/lists/websecurity/archive/

-------------------------------------------------------------------------
This List Sponsored by: SpiDynamics

ALERT: "How A Hacker Launches A Web Application Attack!"
Step-by-Step - SPI Dynamics White Paper
Learn how to defend against Web Application Attacks with real-world
examples of recent hacking methods such as: SQL Injection, Cross Site
Scripting and Parameter Manipulation

https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl
--------------------------------------------------------------------------