81–88 of 88 posts
Earlier quoted context omitted.
> My list of ATM defensive rituals grows even longer. As does my list of potential sources for free thermal cameras. That said - I’ve yet to find a skimmer, even though I check for them every time I use a terminal.
This is the best idea yet. The best defense is a good offense.
Earlier quoted context omitted.
This is the best idea yet. The best defense is a good offense.
Until you get caught dismounting the scammer's hardward by the bank's security.
My list of ATM defensive rituals grows even longer. For those who think time at ATM matters, consider a thermal camera like the one at the start of the video, concealed in the cabinet by fake panels. You enter your PIN, move your hand away to touch the screen seconds later, you're pwned. Thermal cam has your digits and vague sense of hand movements. Cover the keypad with your other hand, take detours when moving your…
what's easier, doing an elaborate dance every single time you touch an ATM, or cancelling your card and having the bank revert the transactions in the relatively slim chance of fraud ? :)
Earlier quoted context omitted.
That's probably better. But moving entirely from "things I know" to "things I own" comes with its own set of security disasters waiting to happen. We are better off using those to augment the password than to replace it.
I don't think "things I own" is a bad security model in itself. The ideal of authentication (to me) seems to be some kind of USB dongle with your private key baked in the hardware, that you can use to create digital signatures proving your identity. Short of stealing the dongle, there is no way anyone can steal your identity.
Earlier quoted context omitted.
I don't think "things I own" is a bad security model in itself. The ideal of authentication (to me) seems to be some kind of USB dongle with your private key baked in the hardware, that you can use to create digital signatures proving your identity. Short of stealing the dongle, there is no way anyone can steal your identity.
Using your dongle example, how do you access important services away from home? Carry the dongle everywhere? If so, you risk losing the dongle. Same with your phone as the "thing I own". That's great, until the phone dies/breaks/gets lost. Hopefully you have a tablet as backup, or the paper copy of your one-time codes in your wallet. I don't have a good answer. I just hate the idea of needing to access banking servic…
Which is not bad in itself, but sometimes there's no obvious immediate impact. That's the beauty of science. You do it to learn about something, and somebody may be interested in that something further down the line. E.g. MRI research came from hypercolliders / space research. It's unlikely particle smashers wrote "this could be used to generate medical images" in their conclusions section. At most they probably wrote "this could be used to create black holes and kill everybody" instead. (/s)
Having to come up with a half-baked impact case as an afterthought in the conclusion, often manages to ruin the entire paper for me. It's the case for this article too. I was like, "wow, wow, wow, interesting", until I reached the "this could be used to ban thermal cameras" part, at which point I was "no, no, no, God no".
It is well past time to stop using passwords. We should be using TLS client certs (as in mutual TLS aka mTLS) or WebAuthn passkeys already. I prefer certs because they don't require support in the web application, but they have a terrible UI and browsers seem to be making that worse, so WebAuthn it is, I just wish WebAuthn would have a standardised HTTP header or TLS extension so it would be usable without JavaScript…
That's probably better. But moving entirely from "things I know" to "things I own" comes with its own set of security disasters waiting to happen. We are better off using those to augment the password than to replace it.