Text 12247, 43 rader
Skriven 2010-11-17 17:29:50 av Robert Bashe (2:2448/44)
  Kommentar till text 12232 av Michiel van der Vlist (2:280/5555)
Ärende: Unbelieveable stories
=============================
Michiel van der Vlist wrote to Robert Bashe on Wednesday November 17 2010 at
12:16:

RB>> Of course, even key disk HBCI is a good deal more secure than any of
RB>> the systems using PINs and TANs (one-time and temporary transaction
RB>> numbers),

MV> Is it? I am not so sure. I think one time transaction numbers are
MV> pretty hard to circumvent. whereas this key disk... what if your
MV> system is infected with malware and someone reads the disk whilke you
MV> are performing a transaction?

You'd need the disk plus the password to achieve anything, and aslthough that
would theoretically be possible, you'd have to steal the disk from my office
and get the password with a keylogger. It wouldn't do you any good to read out
the disk alone, since there are several files on it, all encrypted, and without
the password even the disk is useless.

Naturally, a chip card with an external reader including a keypad for the
password is even more secure, but is (for me) overkill and would cost a fair
sum (card reader plus fee for the card plus - at some banks - even an annual
fee). I'm pretty satisfied with the security I presently have.

Oh, I should note that one of the advantages of this HBCI (Home Banking Common
Interface - despite the English name a German invention) system is that you can
download all the account data and make multiple funds transfers in one go just
by inserting the key disk and tying in the password once. No need for multiple
TANs for multiple transfers - the HBCI system gives you a secure public
key-encrypted session.

RB>>  so I'm pretty satisfied as I am.

MV> I am satisfied with the TAN system.

In its various modifications (iTAN, mTAN...). Better by far than anything
available in the States, anyway. I often wonder why transaction numbers are
apparently not used there - is that only a matter of cost and convenience? Sure
seems risky to me.

Cheers, Bob

--- GoldED+/W32 1.1.5-0613
 * Origin: Jabberwocky System - 02363-56073 ISDN/V34 (2:2448/44)