The bank fraud blame game

[Peter Gutmann]

Stefan Lucks <lucks at th.informatik.uni-mannheim.de> writes:

>There is a big difference between a TPM providing this kind of service, and
>Peter's device. The TPM is supposed to be hard-wired into a PC -- so if you
>are using it to safe your banking applications, you can do banking at one
>single PC. On the other hand, Peter's device is portable, you can use it to
>do safe banking from your PC at home, or in the office (only during lunch-
>breaks with the employer's permission of course), or even at a public
>internet cafe. To this end, Peter's device would be much more useful for the
>customer than a TPM ever could be.

The portability aspect was one contributing factor, but the other one was more
philosophical.  As Dan Geer put it recently, "If you're losing at a game that
you can't afford to lose, change the rules".  We've been trying since at least
the mid-1960s to move the insecurity away from the computer using an entire
industry's worth of gadgets and tricks, and yet we're falling further and
further behind the attackers.  The external-authorisation-box approach changes
the rules and instead moves the computer away from the insecurity.  Since the
only interface to the computer is "feed in blob" and "retrieve blob", it
doesn't matter how insecure the surrounding environment is, there's not much
that it can do to the auth-box.

>BTW, Peter, are you aware that your device looks similar to the one proposed
>in the context of the CAFE project? See
>http://citeseer.ist.psu.edu/48859.html

I had the feeling it sort of collapsed under its own complexity, the smart
card/EMV/etc problem that I referred to earlier.

Philipp =?iso-8859-1?q?G=FChring?= <pg at futureware.at> writes:

>About 50% of the online-banking users are doing personal online banking on
>company PCs, while they are at work. Company PCs have a special property:
>They are secured against their users. A user can't attach any device to a
>company PC that would need a driver installed.

The external device emulates a standard USB memory key, to send data to it you
write a file, to get data back you read a file (think "/dev").  There's no
device driver to install, and no particularly tricky programming on the PC
either.

Peter.

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com