Re: Crypto dongles to secure online transactions

2009-11-21 Thread Anne Lynn Wheeler
On 11/18/2009 12:22 PM, Bill Frantz wrote: Perhaps I'm missing something, but my multiple banks will all accept my signature when made with the same pen. Why wouldn't they not accept my signature when made with the same, well protected, signing/user verifying device. I might have to take it to

Re: Crypto dongles to secure online transactions

2009-11-21 Thread Alexander Klimov
On Wed, 18 Nov 2009, Bill Frantz wrote: Perhaps I'm missing something, but my multiple banks will all accept my signature when made with the same pen. Why wouldn't they not accept my signature when made with the same, well protected, signing/user verifying device. I might have to take it to

Phone company phishes its own users

2009-11-21 Thread Peter Gutmann
There have been numerous posts to this list about banks phishing their own users so I figured I'd start a new thread about other companies who are potential phishing-targets doing this as well, in this case a phone company. From the fraud-alert support forum of Vodafone:

Why the onus should be on banks to improve online banking security

2009-11-21 Thread Peter Gutmann
There's been a near-neverending debate about who should be responsible for improving online banking security measures: the users, the banks, the government, the OS vendor, ... . Here's an interesting perspective from Peter Benson peter.ben...@codescan.com, reposted with permission, on why the

Re: Crypto dongles to secure online transactions

2009-11-21 Thread Peter Gutmann
John Levine jo...@iecc.com writes: I told him about an approach to use a security dongle that puts the display and confirmation outside the range of the malware, and although I thought it was fairly obvious, he'd apparently never heard it before. Some general thoughts on this, there have been