full-disclosure - Bank of America SiteKeys ineffective?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <07b801c562af$b75188e0$6fd4a8c0@othello>
Date: Fri May 27 12:32:47 2005
From: niceman at att.net (Mike N)
Subject: Bank of America SiteKeys ineffective?

http://news.com.com/Bank+of+America+takes+on+cyberscams/2100-1029_3-5722035.html?tag=nefd.top

While I applaud Bank of America for being the first to take serious steps to 
combat phishing, SiteKey only elimintes one class of attack - the simple web 
site that masquerades as the real site.

  From what I can see in the article, SiteKey does not make use of digital 
certificates to identify the user.  Therefore it does nothing to eliminte 
the class of more sophisticated man-in-the-middle attacks already in use 
which make use of DNS poisoning to take users to the wrong site.
  -   For this case the browser will cough up the cookie to the phisher 
site, which they can pass on to the BofA site.  This will trigger the BofA 
site to send back the image and phrase to the user via the Phisher site. 
The user will enter the login and password; being none the wiser until it 
fails or he is taken to the Phisher login action of choice.

  Bottom line: The only way be reasonably sure you are at your bank's site 
is to go to a secure login page and examine the certificate to be verify 
it's issued by a reputable certificate issuer to your bank in your bank's 
locality.  If your bank uses a discount certificate issuer that you don't 
recognize, don't trust them and get your bank to go with the real thing. 
And better yet, bookmark the secure page to minimize chances of a typo 
taking you to a secure type-alike site.