Introduction - If you have any usage issues, please Google them yourself
Keylogging and phishing attacks can extract user identity
and sensitive account information for unauthorized access to users’ financial
accounts. Most existing or proposed solutions are vulnerable to
session hijacking attacks. We propose a simple approach to counter these
attacks, which cryptographically separates a user’s long-term secret input
from (typically untrusted) client PCs a client PC performs most computations
but has access only to temporary secrets. The user’s long-term
secret (typically short and low-entropy) is input through an independent
personal trusted device such as a cellphone.
(good)Using a Personal Device to Strengthen Password Authentication from an Untrusted Computer.pdf