3 ms·
The point being that the malware either has to horn in on a legitimate request (and I'm not sure if that's possible or not given how PKI), or issue its own requ
by Karunamon 10y ago
The point being that the malware either has to horn in on a legitimate request (and I'm not sure if that's possible or not given how PKI), or issue its own request, which the user has to authorize with password, ideally out of band using a hardware pinpad.
- lisper 10y ago> ideally out of band using a hardware pinpad Not "ideally". Critically. Without an out-of-band PIN the card is easy to compromise. And most cards don't have input devices. And even with a secure PIN entry, without a display you can't actually know what transaction you are authorizing. So yes, the malware would have to "horn in" on a legitimate request. But if your machine is pwned that's not hard.