Hot answers tagged

13

It's All About the Security Model We see reference to "Checking for jailbroken/rooted device" in nearly all Mobile Application Security Checklists (e.g OWASP). When comparing it to desktops or web browsers we have to keep in mind that they have different threat models. For example on desktop machines when designing an application we already know that there ...


3

Thanks to comments from @Anders (thx!), I'm unsure if the password generator is a shared service or a personal authentication token like digipass or SecureID. Password generator is a shared service In this situation, Alice can only get the signed response H(R,K) by proving to the password generator that she is Alice by presenting her PIN. If Alice knew K, ...


1

It is important to remember that unlike many other protocols and methods for interconnection, SWIFT transactions are meant to run in a completely isolated environment (i.e. only over established, protected links between banks). Trusting the efficacy of the connection security might be a bad decision (failure of defense in depth), but at this point the ...


1

Among other things Swift is a cooperative organization of financial institutions who agree to using the same standardized messaging system for financial transactions. As such they publicly promote the use of ISO 20022 as their primary standard for messaging between financial institutions. That said each member may implement this standard using a very wide ...


1

The quote is short, but I think the author is trying to say that the router wasn't about ATM skimming, and not even about the ATM itself. It was a MITM for customers who used WiFi (personal devices). In this case, it was just a rogue AP that presented a fake certificate to users, and the users (or their poorly written apps) had to accept the fake ...



Only top voted, non community-wiki answers of a minimum length are eligible