12
Apr
2007
MFA not all it's cracked up to be
Christopher Soghoian at Slight Paranoia has a great example of how MFA isn’t the end-all-be-all some wanted it to be.
In his article, A Deceit-Augmented Man In The Middle Attack Against Bank of America’s SiteKey ® Service , he demostrates how a phisher can bypass elements of image-based MFA, such as SiteKey. They even have a video!
CU’s need to carefully review their MFA policies and the software they have in place to monitor their online security.
See our own post here about BofA and SiteKey security flaws.
Otto’s talking about BofA’s SiteKey problems too! Go check out his post here.
We are using BioPassword (www.biopassword.com) – we think it is a member centric solution.
I love the idea that idea! The way people uniquely type passwords is fascinating to me. We’re using a cookie-token method that I’m not that estatic about.