WIRED Staff
Security

Man-In-The-Middle vs. Cute Password Fob (InterTube RoundUp)

Those great little security fobs that churn out seemingly random numbers that some banks and brokerage houses are handing out?† Not perfect security, as Bruce Schneier points out by pointing to the blog of the Washington Post’s security guru Brian Krebs. Here’s a report of phishers defeating two-factor authentication using a man-in-the-middle attack. The site […]

Those great little security fobs that churn out seemingly random numbers that some banks and brokerage houses are handing out?† Not perfect security, as Bruce Schneier points out by pointing to the blog of the Washington Post's security guru Brian Krebs.

Here's a report of phishers defeating two-factor authentication using a man-in-the-middle attack.

The site asks for your user name and password, as well as the token-generated key. If you visit the site and enter bogus information to test whether the site is legit -- a tactic used by some security-savvy people -- you might be fooled. That's because this site acts as the "man in the middle" -- it submits data provided by the user to the actual Citibusiness login site. If that data generates an error, so does the phishing site, thus making it look more real.

I predicted this last year.