4 ms·
The communications from RSA were that, based on what they knew, there wasn't a huge reduction is security as long as the PINs chosen where reasonably strong. I
by SoftwareMaven 15y ago
The communications from RSA were that, based on what they knew, there wasn't a huge reduction is security as long as the PINs chosen where reasonably strong.
I wonder which applies: RSA didn't know how bad the breach really was; RSA lied about how dangerous the breach was and how open their customers were; LCMO configured their system such that weak PINs were allowed; or something else happened.
- rst 15y agoNews reports elsewhere say that the PINs were captured by keyloggers, so their strength (as in difficulty in guessing) was irrelevant. So, either RSA wasn't thinking about keyloggers as a component of a combined attack --- even though replay attacks using captured interaction streams are the main threat that SecurID was designed to counter --- or they were being disingenuous.