Re: Forced use of list-boxes as a security measure?

> I've experienced an interesting security-related justification for a
specific keyhole problem: that of forcing the user to use list-boxes to
specify the month, day, and year of a date (Section 6.2).  I have a savings
account with egg.com, one of the first internet-based banks in the UK.  Part
of their user authentication procedure involves entering your date of birth.
When they first started, this could be entered by typing into three separate
fields.  However, it was later changed to use list-boxes for the fields,
with the accompanying justification that this change was made to increase
security for uses who unwittingly had a key-stroke monitoring Trojan on
their computers!

BAH. Was that the justification?  I'd definitely drop connection with a firm
feeding me with such bullshit.  At least if security really counts.  They
unlikely has any science-based security installed.

>This is an interesting security tradeoff: it undoubtedly makes life harder
for anyone trying to key-snoop their way into an egg.com account, but it
also makes the interface infuriating for all their users.

This is a clear case of a well known pattern.  To harass innocent users to
gain some _claimed_ security increase.  In a field of a never studied and
understood problem.  (I mean by the implementer, not by the security
experts.)  And with a naive solution that has (almost) nothing to do with a
problem let alone solve it, but create a plenty of work to lots of people.
You can see a mass of such "security" measures installed after 9/11.

It's a basic fact that if someone has ability to install a trojan on your
system, you're exposed, naked.   The only solution is to halt, and install
stuff, recreate the security base from scratch.   Patching a compromised
system is pointless.

(Not to mention, how a date gets in conjunction with security in the first
place? Is that supposed to be a secret info or what?)

[Anyone interested in security issues may want to read Bruce Schneier --
www.counterpane.com ]

Paul