Slashdot Mirror

SiteKey-like authentication should be the industry norm. I have to prove who I am to access my account

If you were reading /. [on a particular day] back in 2007, you would have seen this: Study Finds Bank of America SiteKey is Flawed. Also, see this: Vulnerability of Passmark Sitekey at Bank of America Reported. No site is really secure. Also, while BofA's site isn't bad from a usability perspective, I definitely prefer Wells-Fargo, which will be available in your area soon enough.

I just ran the test on 1.5.0.7 and I am not affected.

Somehow Firefox 1.5.0.8 seems to allow this exploit also. Are you sure 1.5.0.7 isn't vulnerable? If so, then wow I guess things went backwards between the two releases.

maybe it doesn't work the same on ubuntu

Although this could actually be why, I ran the test on a Windows XP Pro machine. If this only happens on Windows (though I don't know this for certain) chances are it might not be the Firefox team's fault after all. Interesting that 1passwd appears to have released a new version of their password manager little over a week ago before this exploit became publically known. Mac users might like the OS X keychain integration.

The solution support automatically to detect infected computers by monitoring the network activity and isolate them.