Yes, we must be concerned with the other avenues of attack on Web transactions. But Mr. Schneier shouldn't pretend that beefing up authentication is without merit. We have decent countermeasures to MITM and trojan attacks now. It is called SSL and anti-virus/spyware software.

What we don't have is an industry accepted standard for enforcing good password selection -- a truly sad predicament. And since two-factor authentication effectively eliminates that concern we can actually start deterring script kids that just grab a password combo list off the Internet.

There will be sophisticated attackers who will still commit fraud using keystroke loggers, phishing attacks, session ID prediction, etc. But we haven't given up on any other security solutions just because we knew it would only raise the bar and not eliminate the risk.

Bruce K. Marshall

www.PasswordResearch.com

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/10694/30897#30897