June 13, 2005 7:45 PM PDT

'Trusted displays' suggested as online security boost

Related Stories

Microsoft to flash Windows ID cards

May 18, 2005
STANFORD, Calif.--The security of online transactions could be bolstered by adding a display and a set of buttons to a smart card reader or security token, a Microsoft researcher said Monday.

Smart cards and security tokens, which are becoming more common for user authentication, already contain cryptography modules. These could also be used to confirm transactions in a secure way, Dave Steeves, a Microsoft security software engineer, said in a presentation at a TIPPI (Trustworthy Interfaces for Passwords and Personal Information) workshop at Stanford University.

When banking online, for example, a small display bolted onto the smart card reader or USB token would show details of a transfer that has been entered into the bank's Web site. The user would then approve the transaction by hitting the "accept" button on the device, or kill it by pressing the "deny" button, said.

"Users are working on the Internet and banking insecurely, except when they have to approve a transaction, they reach and hit accept on the trusted device," Steeves said. The action would be like approving a digital copy of a receipt, one member of the audience observed.

An alternative to the buttons would be for the reader or token to display an accept code, which the user would enter into a box on the Web site, Steeves said.

Smart-card readers and tokens are "trusted devices," Steeves said. By using these not only for authentication but also to confirm transactions, the security of online banking is taken further away from the insecure PC and into secure devices, he said.

"Even if your (PC) is owned, you can't own this (device) remotely," Steeves said.

Still, Steeves had to admit that his idea of secured displays, like many security ideas, is not bulletproof. A sophisticated man-in-the-middle attack could still allow an attacker to take over a user's online banking session, he conceded during a question-and-answer session.

Steeves noted that his work is conceptual and not directly related to any product Microsoft is working on, and it may never become a product, he said.

Others at the Redmond, Wash.-based software maker are busy working on products that are in a more advanced stage of development. Recently, Microsoft shipped a test version of software code-named InfoCard, which aims to help users deal with the plethora of Internet logons and passwords and to make secure payments at Web sites.

1 comments

Join the conversation!
Add your comment (Log in or register)
Sounds like a hassle
Seems like a lot of potential hassle.

I'd rather just be issued an RSA SecurID like my wife has for work for her e-mail.
Posted by TV James (681 comments )
Reply Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

Inside CNET News

1-2 of 12

Scroll Left Scroll Right

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.

Markets

Market news, charts, SEC filings, and more

Related quotes

Microsoft (0.28%) 0.08 30.58
Dow Jones Industrials (0.57%) 72.81 12,874.04
S&P 500 (0.68%) 9.13 1,351.77
NASDAQ (0.95%) 27.51 2,931.39
CNET TECH (0.84%) 17.13 2,049.14
  Symbol Lookup