[ news_security_news ]
Two-Factor Security Threats Still Exist
David Utter
Staff Writer
2007-05-18
 Security News RSS Feed
Two factors of security are better than one, but the extra factor does not guarantee complete safety from potential threats.
By all means, let's get a two factor authentication security plan in place for financial institutions. The age of the username/password as being enough security for people has been in the rear view mirror for a long time.
Promising solutions for more effective security have been in development for some time. One that has been in existence for a while, but not widely distributed, is the security token. Used in government and some private sector businesses, a token generates a number that serves as a time-sensitive extra key to gaining access to a secure resource.
Once the token expires, it cannot be reused. In conjunction with a username and password, the current security model in use by online industries and financial institutions would be much improved. Conventional phishing attacks that grab a username and password become useless without the security token.
That escalates the stakes for criminals, and Symantec security researcher Zulfikar Ramzan thinks they will respond.
"If two-factor tokens become more prevalent, I suspect phishers will change up their game and more attacks will be conducted in real time," he said.
Phishers would have to work faster, with an automated man in the middle phishing site that would pass through the normal login plus the extra token credential to the legitimate site. But an effective phishing detection tool, be it browser- or toolbar-based, should help people detect those fake sites before entering any information.
Internet Explorer, Firefox, and Opera all have something available either internally or available as an add-on to do this today. Configured properly, they should help keep people from throwing their tokens through a phishing site.
"Ultimately, such tokens are not going to provide an adequate defense," said Ramzan. "However, for the time being they do have merits."
---
Phishing, Two Factor, Authentication, Security
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Security News RSS Feed
|
|
RSS
Archive
Contact Us
Advertise
