title: How can you prevent Man in the Browser attacks?
body: <p>Been reading up on MitB attacks and some things worry me about this.</p>
  
  <p>From <a href="http://en.wikipedia.org/wiki/Man_in_the_Browser" rel="noreferrer">WIKI</a>: </p>
  
  <blockquote>
    <p>The use of strong authentication tools simply creates an increased level of misplaced confidence on the part of both customer and bank that the transaction is secure.<br><br>
    One of the most effective methods in combating a MitB attack is through an Out-of-Band (OOB) Transaction verification process. This overcomes the MitB Trojan by verifying the transaction details, as received by the host (bank), to the user (customer) over a channel other than the browser</p>
  </blockquote>
  
  <p>So if I get this straight, that the only real safe method is a non browser confirmation method. (like a phone call or some other external tool)</p>
  
  <p>Would an email count as a OOB Transaction? Or could the MitB send a fake email?</p>
  
  <p>Is there a way to prevent MitB with only code?</p>
  
  <p>EDIT: I'm asking this because our local banking system are employing a <a href="http://www.audkenni.is/upimages/lykill_1.gif" rel="noreferrer">physical keygen system</a> for which you have to push to get a number and then enter that number into a field in the transaction form.</p>
  
  <p>I have no idea if that is considered safe, since it looks like a MitB attack is just making it look like everything you did is safe and correct but what actually happened is that the form data was changed on submit and is now transferring to some other bank account. So it would have access to this keygen number.</p>