2-factor, 2-way authentication - the death knell for phishers?
Assuming that this technique is sufficiently widely adopted, what impact will it have in the long run?
While the immediate impact would most likely be the realization of the desired goal, how might phishers and their ilk adapt, ultimately either defeating this measure or devising new avenues of attack?
==================================================
May 26, 2005
Bank Of America Fights Phishing With New Authentication
By Gregg Keizer Courtesy of TechWeb News
Bank of America, plagued by phishers targeting its 13.2 million online banking customers, on Thursday debuted a new two-factor, two-way authentication scheme in an attempt to deflect identity theft and reduce fraud.
Dubbed SiteKey, the free service allows customers to pick an image, write a brief phrase, and select three challenge questions. The information is then passed back and forth between the customer and Bank of America to confirm each other's identity. SiteKey will debut in Tennessee, said the Charlotte, N.C.-based bank, and roll out nationwide by the end of the year.
Phishers, who try to deceive users into divulging confidential financial information such as bank and credit account numbers, typically use faux Web sites that only look legit. A Bank of America customers registered with SiteKey, for instance, would immediately know that a phishing site was bogus when it wasn't able to provide the proper challenge question.
The same goes in more dire situations, when phishers have hijacked the account username and password via keylogging spyware, a trend that's gaining in popularity among miscreants. Even with that info, the thief won't be able to access a Bank of America account, since he couldn't answer the challenge.
On the customer's side, SiteKey prevents spoofing by letting customers confirm that they're at the real Bank of America site. If after clicking the SiteKey button, the right secret image and phrase don't appear, the customer knows it's a bogus site.
Using SiteKey is like getting a safe deposit box that takes two keys to open, Bank of America executives said. Before the customer and the bank agree to open the box together, they confirm each other's identity. "SiteKey helps you know it's us and we know it's you," said Sanjay Gupta, an exec in Bank of America's e-Commerce group, in a statement
SiteKey's technology is provided by PassMark Security, a Redwood City, Calif.-based authentication vendor.
"Consumers want a safe online environment, but how do they know when they're safe?" said Bill Harris, the chairman of PassMark, in a statement accompanying Bank of America's announcement. "What's striking about the PassMark System is that it's very consumer visible, and that has to be reassuring to the bank's customers."
According to the Anti-Phishing Working Group, more than 80 percent of all phishing attacks target customers of financial organizations such as banks. Bank of America is one of the brands more often hit by phishers, due to its huge size. The bank claims more than 13 million online banking customers and says that 6.4 million of its users pay bills online.