WebApp Sec: Re: Proposal to anti-phishing

[Florian Weimer <fw () deneb enyo de>]

* Rafael San Miguel:

> The solution is based in a hardware token that is
> delivered to every customer. This token includes the
> true certificate that should be presented by the bank
> when a customer access his/her account, and a program
> that checks if the certificate presented by the
> webpage is consistent with the first one. The program
> is in read-only memory so that it can't be modified by
> anything external to it.
It's acceptable neither to customers nor to banks.  These days,
zero-setup online banking is an absolute must.