What if the malware on the PC lets you log in and then takes over the session? Yeah, it happens. I develop on a system (PhoneFactor) where the bank now confirm

What if the malware on the PC lets you log in and then takes over the session? Yeah, it happens. I develop on a system (PhoneFactor) where the bank now confirms the details of a transaction (amount, dest account number, etc) over an out-of-band channel. I really think this is where the world is moving. The current concept of login sessions is going away, e.g., mobile phones keep browser sessions open practically forever. Login credentials will eventually only protect the viewing of data, things that could cost money will be subject to additional authentication. But the party who's interests are most protected will be the party that's purchasing and deploying the authentication system. This is usually not the party with the most to lose, and almost never the end user.