Toolkit

Story: Microsoft: Two-factor authentication would thwart phishers

• 
• 

From Tom:

Here's the idea: If you want to login to your bank account, you would have to provide two different factors. One of them would be provided by a special hardware device, and would change about every five minutes.

Now suppose the user has fallen for a phishing scam, and has be tricked into visiting a bogus Web site. If the victim can be tricked into entering one PIN number, why could he or she not be tricked into entering the second factor? In fairness, the attacker would only have a few minutes to steal the information and send it to a remote location. But in my opinion, that would not be too hard for an attacker to do.

Tom
Thomas L. Jones, Ph.D., Computer Science
DrJones@alum.MIT.edu

• 
• 

• 
• 
• 

Full Talkback thread