> But your point above: > "without installing malware on the victim host" > > Although true on some level, is bogus for the purpose of > this work, as it being written makes an automatic > assumption on working only after malware is installed. The principle of "defence in depth" is that each security measure adds to overall security by providing protections that continue to operate even if other defences have been breached. The demonstration that Citibank's "security measure" can be relied upon ONLY in the case where no other breach has allowed malware to be installed on the client machine is thus a proof by example that it does not actually provide such defence in depth, and in fact for far too many end users cannot be safely assumed to provide any security at all. It turns out that any security it is alleged to provide is entirely dependent on the effectiveness of other security measures already in place. A "security feature" that only delivers security IF you are already secure sounds like a good candidate for Schneier's doghouse. David Gillett
