Re: AW: Magic Bullet (proposal for in-browser secure 2-way authentication resistent to online and offline attacks)

* Dan Schutzer:

> One time passwords are susceptible to real time man in the middle
> attacks

You don't even need real-time attacks, you just block every other
transaction, claiming that the password has already been used, and
have the Trojan horse send you those unused passwords.  That's why
it's interesting to tie one-time passwords to particular transactions.

There are very complex trade-offs involved, and the whole thing is a
topic of ongoing research, on both sides.

> Cookies can be insecure if they store sensitive information in the clear

A lot of sensitive cookies are insecure because they aren't restricted
to HTTPS. 8-(