Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[omega2018]

A brief report of Rapport, I have read elsewhere that it isn`t good.

only problem i have seen with rapport is occasionally they lag behind Chrome releases resulting in rapport not protecting a bank login page as it should.  never seen it cause a problem itself. 

unlike some of the products the site in that link promotes eg Avast!

Class yourself one of the lucky few.

The majority of the major UK banks still recommend IBM's Rapport .

[TheBoy]

A brief report of Rapport, I have read elsewhere that it isn`t good.

only problem i have seen with rapport is occasionally they lag behind Chrome releases resulting in rapport not protecting a bank login page as it should.  never seen it cause a problem itself. 

unlike some of the products the site in that link promotes eg Avast!

Class yourself one of the lucky few.

The majority of the major UK banks still recommend IBM's Rapport .

And that's not based on technical reasons, but commercials.  Think along the lines of "we'll give you a discount on your shiny Z series hardware support if you get our shitty software on millions of devices"


Rapport is known to be problematic. Trust me on this

Just because I recommend some boil their heads, that doesn't mean they should.

[omega2018]

The majority of the major UK banks still recommend IBM's Rapport .

And that's not based on technical reasons, but commercials.  Think along the lines of "we'll give you a discount on your shiny Z series hardware support if you get our shitty software on millions of devices"

that would make sense if all the banks that recommend IBM rapport used IBM hardware.  they don't. 

[STEMO]

Barclays recommend the Ruskies 

[TheBoy]

The majority of the major UK banks still recommend IBM's Rapport .

And that's not based on technical reasons, but commercials.  Think along the lines of "we'll give you a discount on your shiny Z series hardware support if you get our shitty software on millions of devices"

that would make sense if all the banks that recommend IBM rapport used IBM hardware.  they don't.

That was an example. Bloody hell you are hard work.

OK "we'll give you $1m to shove our shit on plebs PCs, as you don't use any of our hardware, software, or support (unlikely)"

[Viral_Jim]

I've never installed Rapport, or any of those other bobbins bits of security. What is it supposed to do that simply operating over https does not?

[aaronjb]

I've never installed Rapport, or any of those other bobbins bits of security. What is it supposed to do that simply operating over https does not?

It performs client-side inspection; looking for keyloggers, browser hooks etc etc, which HTTPS means nought to - it's no good securing the data in-transit if it's already been stolen when it was at-rest https://krebsonsecurity.com/2010/04/a-closer-look-at-rapport-from-trusteer/

There are other solutions that require no client-side install, but they are more complex for the site owner to implement (disclosure: I work for a company selling one such solution) as they require tight integration with the site itself rather than a "drop in" client side application.

[Doctor Gollum]

So to simplify it, most products are mere fences, where as what you offer is more of a custom bunker with the core system integrated into the very fabric of it...

[omega2018]

I've never installed Rapport, or any of those other bobbins bits of security. What is it supposed to do that simply operating over https does not?

It performs client-side inspection; looking for keyloggers, browser hooks etc etc, which HTTPS means nought to - it's no good securing the data in-transit if it's already been stolen when it was at-rest https://krebsonsecurity.com/2010/04/a-closer-look-at-rapport-from-trusteer/

There are other solutions that require no client-side install, but they are more complex for the site owner to implement (disclosure: I work for a company selling one such solution) as they require tight integration with the site itself rather than a "drop in" client side application.

thanks its nice to see a link here that is reasonable and rational and not FUD.

[aaronjb]

So to simplify it, most products are mere fences, where as what you offer is more of a custom bunker with the core system integrated into the very fabric of it...

When you get down to it all security products are really just fences of differing heights.. some are 3' chain link, some are 18' concrete, but given sufficient time and resources and attacker can (and will) get past any of them (especially if they're nation state!)

[TheBoy]

There are other solutions that require no client-side install, but they are more complex for the site owner to implement (disclosure: I work for a company selling one such solution) as they require tight integration with the site itself rather than a "drop in" client side application.

I was using some of "your" products, still in their boxes since you shipped them nearly a year ago, as a table and a step ladder the other day.  Most expensive table I've ever used as a step ladder


As you know, but others may not, if you control the client, you can do what you like in the middle - including on the fly decryption of https. And redirection of all traffic, encrypted or otherwise 

[TheBoy]

So to simplify it, most products are mere fences, where as what you offer is more of a custom bunker with the core system integrated into the very fabric of it...

When you get down to it all security products are really just fences of differing heights.. some are 3' chain link, some are 18' concrete, but given sufficient time and resources and attacker can (and will) get past any of them (especially if they're nation state!)

Absolutely.  Although these fences often conflict with one another, in the same way running 2 AV solutions can trip up (and REMOVE!!) the other.


Rapport is seen to be too buggy and inconsistent to be recommended by most independent consultants.  Mind you, Kaspersky is also going through a bad time at the moment, with constant rumblings that won't go away that the Russian authorities have code in there to give back door access.  And Symantec as well, given their business' of SSL certificates (through subsidiary Verisign) and border inspection (subsidiary Bluecoat), and "accidentally" signing Bluecoat's scanner's internal intermediate certificate - meaning a Bluecoat scanner can decrypt any PKI encrypted traffic, including https, irrespective of the client trusting Bluecoat (now Bluecoat claim that has never been sent outside of its test labs, but I suspect that the large US authorities have the capability)

[Kevin Wood]

In other words, if you want it to be secure, use this envelope and a stamp.

[TheBoy]

In other words, if you want it to be secure, use this envelope and a stamp.

Not really, as that's susceptible to MiM as well.

Deliver by hand

[omega2018]

The majority of the major UK banks still recommend IBM's Rapport .

And that's not based on technical reasons, but commercials.  Think along the lines of "we'll give you a discount on your shiny Z series hardware support if you get our shitty software on millions of devices"

that would make sense if all the banks that recommend IBM rapport used IBM hardware.  they don't.

That was an example. Bloody hell you are hard work. Bloody hell you don't always agree with every precious word I say

OK "we'll give you $1m to shove our shit on plebs PCs, as you don't use any of our hardware, software, or support (unlikely)"

fixed that for you