WebApp Sec: RE: Proposal to anti-phishing

[ACMurray () cmp com]

Hi Rafael,

AOL announced a similar offer a few months ago called PassCode. They send an RSA
SecurID token to customers who sign up for the service (I think they're charging
10 bucks for the token and $1.95 a month for the service).  I haven't heard how
much uptake they've gotten.

While two-factor authentication is great, if every bank, ISP, and e-commerce
provider goes this route, customers are going to drown in little plastic gizmos,
have to remember more passwords/PINs, and go through the headache of dealing
with lost/broken tokens.

It's also not going to get you off the hook of designing your Web apps to
withstand cross site scripting, SQL injection, etc. etc. etc.

That said, anything that can prevent consumers from being victimized by scammers
is a good thing.

Best,
Andrew Conry-Murray
Technology Editor
Network Magazine
acmurray () cmp com
(415) 947-6342

*****************************************************************
INNOVATIONS 2005
Nominate your product now for Network  Magazine's
Innovations Award. More details can be found at:
http://www.networkmagazine.com/innovation-awards/
*****************************************************************


                                                                       
                      "Don Tuer"                                       
                      <don.tuer () cgi co         To:      "'Rafael San Miguel'" <smcsoc () yahoo es>, <webappsec () 
securityfocus com>
                      m>                       cc:      <Enrique.Diez () dvc es>
                                               bcc:                    
                      01/14/2005 07:28         Subject: RE: Proposal to anti-phishing
                      AM                                               
                                                                       
                                                                       




Two phased authentication is good for security but some obvious
disadvantages include:

             - Cost of hardware tokens
             - Cost of distribution
             - Cost of managing hardware
             - Complexity and user training

             Also will the user need to return their token for replacement if
they forget the PIN?

Thanks
Don

-----Original Message-----
From: Rafael San Miguel [mailto:smcsoc () yahoo es]
Sent: Wednesday, January 12, 2005 4:37 AM
To: webappsec () securityfocus com
Cc: Enrique.Diez () dvc es
Subject: Proposal to anti-phishing


Hi all,

I am currently working on a security design that
involves an innovative strategy to combat phishing. I
have something in mind that seems to work allright.

The solution is based in a hardware token that is
delivered to every customer. This token includes the
true certificate that should be presented by the bank
when a customer access his/her account, and a program
that checks if the certificate presented by the
webpage is consistent with the first one. The program
is in read-only memory so that it can't be modified by
anything external to it.

The customer will not be able to access his/her
account if the token is not plugged in, or if the
check fails.
Note that it is the token who sends credentials, not
the client. Also, the token is PIN-protected to
prevent unauthorized use.

I don't see any obvious disadvantages to this
solution.  Hope this helps other people researching
for anti-phishing techniques.

Greetings,

Rafael San Miguel Carrasco

-------------------------------
Rafael San Miguel Carrasco
Consultor Técnico
rafael.sanmiguel () dvc es
+ 34 660 856 647
+ 34 902 464 546
Davinci Consulting - www.dvc.es
Oficina Madrid - Parque empresarial Alvento
Via de los Poblados 1 Edificio A 6ª planta
28033 Madrid
-------------------------------