RE: [fw-wiz] Transitive Trust: 40 million credit cards hack'd

From: Marcus J. Ranum (mjr_at_ranum.com)
Date: 06/19/05

  • Next message: Paul D. Robertson: "[fw-wiz] Equifax Canada" 
    To: David Lang <david.lang@digitalinsight.com>
Date: Sun, 19 Jun 2005 17:39:47 -0400

    David Lang wrote:
    > 2. require authentication that isn't fully contained on the remote system (i.e. a token or one-time password, a digital certificate with a passphrase is NOT good enough)

    That doesn't work, either. If you assume that the endpoint is insecure
    (and it is, so that's a safe assumption) the 2 factor authentication works
    only because it's harder to bypass than a password. If everyone was
    using 2 factor authentication, you can bet hacker toolkits would be
    full of nasty rootkits and malware that stole live sessions, or typed
    keystrokes into live sessions once they came up (transparently, of course)

    mjr.

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Paul D. Robertson: "[fw-wiz] Equifax Canada"

    Relevant Pages