Re: Requirement for Payment Platforms - Trusted GUI

Can one ever really trust their own systems? In the post NSA revelation world, can we even trust our hardware?

> On Oct 31, 2013, at 8:33 PM, "David I. Lehn" <dil@lehn.org> wrote:
> 
> On Tue, Oct 22, 2013 at 8:08 AM, Anders Rundgren
> <anders.rundgren.net@gmail.com> wrote:
>> For payment operations you ought to have a trusted GUI.
>> It would be nice to get a list of possible options for achieving this.
> 
> The problem with most GUIs is that an attacker can emulate what the
> GUI looks like and intercept your secure data.  You could show secrets
> (pictures, etc, etc) that are only accessible via the trusted GUI.
> But then you have to make sure users understand how and why to set
> that up properly, and ensure that they are trained to notice if those
> secrets do not appear.  That seems like the hard part.
> 
> -dave
>