3 ms·
It's actually even worse than that: they keys on the virtual keyboard are displayed in a random order instead of QWERTY.
by MichaelDickens 8y ago
It's actually even worse than that: they keys on the virtual keyboard are displayed in a random order instead of QWERTY.
- FabHK 8y agoWell, that's better though. So even if there's a key logger and mouse click recorder on your machine, one cannot recover your password. Though, if your machine is that compromised, might as well have a screen recorder, too. Though that would create more outgoing traffic.
- jiveturkey 8y agodon't need a screen recorder. the keycap images are trivially machine readable. this technique is actually good if implemented correctly -- with secure display where the host OS cannot read the image data. some predecessor to SGX whose name I don't recall had this feature. the idea is to enter a PIN though, not a friggin password. treasurydirect seems to have only taken away the trivial aspect of it without understanding the underlying reasons and details. you know, like what most companies do with Agile.
- darkhorn 8y agoThis means that they don't use 2FA. In Turkey 2FA is mandatory for all banks, via SMS or app on the phone.