3 ms·

You could probably just use a bank that utilizes tokens or some other two factor authentication.

• shabble 15y ago
  ...Unless they're RSA SecurIDs. Although it seems that whoever got that info used it for poking into defence contractors, rather than banks. Still, I imagine it's perfectly possible they could have used it to defeat some multi-factor logins for large bank accounts. I wonder how long the recall and replacement will take; there's got to be a lot of those tokens out there.
• marshray 15y ago
  What if the malware on the PC lets you log in and then takes over the session? Yeah, it happens. I develop on a system (PhoneFactor) where the bank now confirms the details of a transaction (amount, dest account number, etc) over an out-of-band channel. I really think this is where the world is moving. The current concept of login sessions is going away, e.g., mobile phones keep browser sessions open practically forever. Login credentials will eventually only protect the viewing of data, things that could cost money will be subject to additional authentication. But the party who's interests are most protected will be the party that's purchasing and deploying the authentication system. This is usually not the party with the most to lose, and almost never the end user.