Tag Info

Hot answers tagged

5

Just use TLS, it's what it was meant for: securely send data between two parties across an untrusted channel. Should you want additional protection, there are two ways to solve this problem that spring to my mind: Use a password to encrypt the symmetric key Use a token such as an OTT through SMS or generated using a smartcard and external cardreader ...


5

There are potential technical options you can pursue, and several of those have been mentioned in other answers, such as global policies or BIOS settings to disable the USB ports, or physically disabling the USB ports. However... My suggestion is that if you have a systemic problem with this sort of thing, it isn't, in fact a technical problem at all, but ...


3

Well, the app is certainly possible. If the app was created for good by a bank, it can be recreated for evil. Especially if the evil app doesn't actually need to handle banking transactions. It could just scoop the credentials and crash. I think the other half of this question is "Are people dumb enough to fall for this?" Absolutely. Stupid is a renewable ...


3

Yes, it loses some of the protection since it fails to protect them if the device is thoroughly compromised. It still, however, protects against any number of limited attacks. For example, if they are configured to connect through a proxy that can strip the encryption, the 2FA will remain safe. If the password DB is compromised somewhere that they used ...


2

What is your threat model? If every connection is sent over SSL, you do not need to worry about anyone sniffing your communications. This is actually the strongest part of your system. Good job choosing something standard. Because SSL is ensuring nobody is listening in on your communications, we should look at the endpoints. Your UUID is basically a ...


2

There is a project called OASAM that aims to define a methodology to test Android devices. You can find it here: http://oasam.org/en The guide has the following sections: OASAM-INFO: Information Gathering: Information gathering and attack surface definition. OASAM-CONF: Configuration and Deploy Management: Configuration and deploy assessment. ...


1

To expand on Ohnana 's answer, yes this is possible. If you were to create an application that essentially looked exactly the same as the bank's login screen, it could scrape the credentials and crash like they suggest. However, when you do that, and people start reviewing your app, it will be heavily rated on the bad (1-2 stars) side, which decreases ...



Only top voted, non community-wiki answers of a minimum length are eligible