The solution isn't placing all the burden on banks - this would (if it were ever implemented) just cost consumers lots and lots of money. Why? Because there is no difference between being taken by a phishing scam and giving your information to your friend. Either way, you wouldn't lose but the bank would. Never happen because it is too open to fraud.

Giving relatively expensive, easy-to-lose tokens to customers just makes it harder, but does not 100% stop attacks. What would stop attacks is (1) complete end-to-end cooperation on user tracking by all ISPs and (2) forceful and swift enforcement by both banks and law enforcement.

How would this stop someone in Russia? Easy. If the ISP doesn't want to play ball to assist in prosecuting criminals - criminals by Russian law as well as US - cut them off. No Internet access. Period. They can't walk away from the table and stay in business, they have to negotiate.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/363/32555#32555