Two-factor phish against Citibank demonstrates the need for mutual authentication

Lance James at Secure Science has screen shots of the phish attack against CitiBank's business site that uses a hardware token one-time password system. You can see them on WaPo's Security Fix Blog.

Before everyone gets all up in arms about this in the blogosphere. Let's talk about authentication types:

Session Authentication - authenticating the user to the host to create a session
• Mutual Authentication - The host is authenticated to the user, as well as vice-versa
• Transaction Authentication - A transaction is authenticated in a manner cryptographically distinct from the session authentication mechanism

Much has been written about how SSL isn't effective against MITM attacks because nobody actually verifies the SSL certificate (this is way WiKID's mutual authentication method checks the cert for the user before showing the OTP).

Transaction authentication could be done via transaction analysis as it is for credit cards, but, while that might be effective for consumer accounts with regular payments, commercial and brokerage accounts would be much tougher. I don't think we need "digital signing", in a strict sense of the term, but I do think you need something that is distinct from the session authentication method or the attacker will fake a session time-out to get the user to give them another passcode. WiKID's ability to handle multiple 'domains' with separate public/private key pairs provides a cryptographically distinct method that uses the same token client.