Text 12253, 47 rader
Skriven 2010-11-18 00:46:10 av Michiel van der Vlist (2:280/5555)
     Kommentar till en text av Robert Bashe (2:2448/44)
Ärende: Unbelieveable stories
=============================
Hello Robert,

On Wednesday November 17 2010 17:29, you wrote to me:

 RB>>> Of course, even key disk HBCI is a good deal more secure than any
 RB>>> of the systems using PINs and TANs (one-time and temporary
 RB>>> transaction numbers),

 MV>> Is it? I am not so sure. I think one time transaction numbers are
 MV>> pretty hard to circumvent. whereas this key disk... what if your
 MV>> system is infected with malware and someone reads the disk whilke
 MV>> you are performing a transaction?

 RB> You'd need the disk plus the password to achieve anything, and
 RB> aslthough that would theoretically be possible, you'd have to steal
 RB> the disk from my office and get the password with a keylogger.

I was not thinking of breaking into your house, I was thinking of infecting
your system with some malware that sends the content of the disk to me when you
insert it in the disk drive.

 RB> It wouldn't do you any good to read out the disk alone, since there
 RB> are several files on it, all encrypted, and without the password even
 RB> the disk is useless.

The malware would also heve a key logger to give me the password.

The problem with your HBCI system is that I have no idea how it works. The TAN
system, I understand, so I can make an evaluation of the risks myself. HBCI? I
have no idea how it works, how strong the encryption is, etc, etc. So how can I
possibly know about its weaknesses and how to minimise the risks.

 RB>>>  so I'm pretty satisfied as I am.

 MV>> I am satisfied with the TAN system.

 RB> In its various modifications (iTAN, mTAN...). Better by far than
 RB> anything available in the States, anyway. I often wonder why
 RB> transaction numbers are apparently not used there - is that only a
 RB> matter of cost and convenience? Sure seems risky to me.

Maybe it is just inertia.

Cheers, Michiel

--- GoldED+/W32-MINGW 1.1.5-b20070503
 * Origin: http://www.vlist.org (2:280/5555)