3 ms·
You are placing a ridiculous expectation on the service provider while excusing the client using any form of security at all! Sorry, but in 2011 it is not beyo
by run4yourlives 15y ago
You are placing a ridiculous expectation on the service provider while excusing the client using any form of security at all!
Sorry, but in 2011 it is not beyond reasonable expectation that a password be kept secret. Getting hacked sucks, certainly. Your company being hacked however is not the liability of your service providers, even if they are banks.
- tptacek 15y agoSpeak to the people deploying multifactor and reputational authentication at major banks, and to a one, they will tell you that it is not considered a reasonable expectation that Windows systems be kept intact in order to secure bank accounts. Banks can't come out and simply say that because of market realities (there are lots of market realities involving software security that terribly impact your day to day life) and concomitant liability.
- marshray 15y agoThe banks we talk to are certainly aware that a significant percentage of the customer-provided client machines are pwned by malware (and not just dumb keyloggers either). The Zeus trojan in particular is currently one of the most-discussed topics in online banking security.
- tptacek 15y agoIt would only be fair to mention your commercial interest in that fact, Marsh. :)
- marshray 15y agotptacek is referring to that I work for PhoneFactor and we sell a multi-factor auth product to secure against these types of things. You're probably right, and thanks for the input. It's hard to know when to worry about not disclosing affiliations and when to worry about sounding like a product name-pusher. I felt like I was on such basic facts in this comment that it wasn't so relevant, but I did mention it in a later comment in this thread.
- tptacek 15y agoDon't get me wrong; I'm glad you're here.