Re: limits of end-user "testing"

On 11/17/05, Luke Fraser <LFraser@soltrus.com> wrote:
> This makes sense to me, but can anyone confirm that banks fraud detection
> systems are this good?

Yes, they are that good and they look for anomalies, odd behavior,
transfers to odd accounts, etc.

As for two-factor authentication being subject to MITM attacks - it
is, but that vulnerability is reduced if two-factor is implemented
correctly and rechallenges users when they try to tranfer money, etc.
Sure, it can still be defeated under certain circumstances, but we
need to be realistic. Banks aren't going to issue smart cards and
readers to their customers any time soon - customers wouldn't stand
for it - so digitally signing transactions is a pipe dream at this
point.