5 ms·

c.f. http://www.schneier.com/blog/archives/2005/03/the_failure_of.html http://www.schneier.com/blog/archives/2005/03/the_failure_of...

• jonknee 17y ago
  Some decent points, but if you require authentication for all transactions the man in the middle attack / trojan won't work. For every transfer have a SMS or phone call triggered to the customer--"We have received a request to transfer $x to Y, to authenticate please press 1." It may get annoying for every transaction, so it could only come into play for transactions to parties that you haven't dealt with in the last X days.
  • swolchok 17y ago
    It might be nicer if you made them say "yes" so that replays could be detected. Pressing 1 makes the same tone every time, so malware on smartphones can easily bypass this authentication method.
    • ubernostrum 17y ago
      If you're going to be that paranoid, the phone can't do it; the malware could simply record your voice saying "yes" and replay that recording as needed.
      • swolchok 17y ago
        Surely, no real person is going to produce the exact same sound twice. Check the database of previous samples for matches or very close matches.
    • jonknee 17y ago
      It's much more difficult to have malware on your computer and on your phone at the same time from the same attacker. But it could be random, do whatever the instructions say (sometimes 1 means yes, sometimes it means no).