Skip to main content

The WiKID Blog

Viewing posts by admin

phishers-targeting-commercial-accounts

Posted by: admin 16 years, 3 months ago

Today I receieved a phish that is targeting commercial accounts of BB&T. It's interesting because it will be much harder to do transaction analysis fraud prevention on commercial accounts (same for brokerage accounts) and the email used a pending 'security device' roll-out as the premise for needing the information.

read more / 0 comments

phishing-target-one-time-passwords-in-swedish

Posted by: admin 16 years, 3 months ago
Just when I thought the nordic countries would be the last to be phished, the phishers strike. Out-law pointed out an this F-Secure post (go to the bottom of the page):

read more / 0 comments

pingid-releases-signon-com-but-it-is-not-strong

Posted by: admin 16 years, 3 months ago

PingID released Signon.com today, which looks like a great addition to the consumer-oriented SSO services available. I take some exception to this quote from PingID CEO Andre Durand about InfoCards

After a user creates an information card on their desktop, they can access SignOn.com and link the card to their account on the site. On subsequent visits, the card is needed for the user to authentication to SignOn.com.
“It’s a form of strong authentication,” says Andre Durand, CEO of Ping Identity.
Now, I don't know as much about InfoCards as I should, but I know it's not strong authentication. What these services need is strong mutual authentication, so that the user is assured that they are going to the correct SSO service. Then, the SSO service needs to get the user to the correct targeted site.

read more / 0 comments

banking-group-sues-tjx

Posted by: admin 16 years, 3 months ago

In an interesting development in the economics of information security and data breaches, a group of banks is suing TJX for "negligent misrepresentation". According to Massachusetts Bankers Association CEO Daniel Forte:

"Banks all across the nation re-issued debit cards as a result of the TJX data breach. Preliminary estimates of the costs vary from institution to institution, up to $25 dollars per card," MBA officials said in a statement. "This alone would run into many millions of dollars for banks throughout the country. Moreover, when fraud occurs, banks generally cover the entire fraud, replacing money in customer accounts to protect their customers."
The banks, which once owned Visa, the creator of the PCI data security standards, now recognize that there costs are an externality in that system. The tort system is a pretty good system for dealing with externalities. Unfortunately for those who like to have real data on these matters, if the case is settled out of court, we probably won't know how much it actually costs TJX. I continue to believe it will not affect their brand or sales , but it will hurt their stock price as would any expenses that do not generate revenue.

read more / 0 comments

more-on-biometrics

Posted by: admin 16 years, 3 months ago
Adam points to a recent academic work on reproducing fingerprints from the 'templates' of data points that most systems use (instead of a full image of the fingerprint).

read more / 0 comments

Recent Posts

Archive

2024
2022
2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom