Bad Ideas in anti-phishing #1353

[John Hardin <jh...@impsec.org>]

This just snuck into my inbox:

On Fri, 15 May 2009, StrongWebmail wrote:

> StrongWebmail launches the world's first email account that can't be 
> hacked. Nobody gets in unless he gets a phone call.

{snip}

> A new service is putting an end to this nightmare. StrongWebmail.com is 
> the first email account to confirm a user's identity using something 
> they know (their password) and something they have (their telephone). 
> When a person successfully enters their username and password, they must 
> receive a phone call or text message to their telephone. The phone call 
> gives them a 3 digits code which they enter into the computer. This 
> ensures that even if someone's password is stolen, the thief would never 
> have access to a person's cell phone.

I can't see anyone keeping this service for more than a day or two, though 
signing up for it using a 976 number might be fun...

-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@impsec.org    FALaholic #11174     pgpk -a jhardin@impsec.org
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   The problem is when people look at Yahoo, slashdot, or groklaw and
   jump from obvious and correct observations like "Oh my God, this
   place is teeming with utter morons" to incorrect conclusions like
   "there's nothing of value here".        -- Al Petrofsky, in Y! SCOX
-----------------------------------------------------------------------
  6 days until the 5th anniversary of SpaceshipOne winning the X-prize