Re: AW: Magic Bullet (proposal for in-browser secure 2-way authentication resistent to online and offline attacks)

* Jörg Schwenk:

> - THE real problem today is mitm with Trojan horses: they have access to
> nearly any information available to the browser. A secure mode (where all
> plugins are disabled when SSL is enabled) would be needed.

And this wouldn't work reliably either because malware isn't
restricted to the official browser APIs.

There is no easy solution, especially if you are a player with a high
market penetration.  The best approach today is to avoid creating the
impression that the whole mess is your problem.  The ISPs are very
successful at that, but it looks like browser vendors are losing it.