Sure, they're a lot more expensive and a lot more "high-tech" but unless they are doing end-to-end client and server authentication and strong crypto _AND_ have their own input and output devices that cannot be interfaced from the host OS _AND_ are required for verifying (virtually) every step of every transaction (in other words -- if you have any of the real-world implementations of banking OTP cards used anywhere in the world, the answer is "no"), they are effectively no better than the Citi OSK's as they are trivially MiTM'ed via on-client malware.
In fact the system used by the major Dutch banks is audited rather extensively. The OTP system is based on an external smartcard reader and a smartcard application on the bank card. They have no physical connection so the web interfcae will present you with a challenge and you must use that challeng, your card and your pin to generate the proper response. Then you have to type in this response.
It is a combination of: - What you have (the card with the smartcard application) - What you get (the challenge from the server) - What you know (your pincode)To the best of my knowldge the transaction value is also part of the calculations. So you can not fix the actual amount and let the other parts just pass by.
I would welcome you to explain us how one can do a MITM attack on that. It is many times harder to break into this sort of system then many of the soft targets relying on fixed username+password prompts.
Dutch law requires extensive external audits on these systems.
Hugo.
--
hvdkooij@xxxxxxxxxxxxxxx http://hugo.vanderkooij.org/
This message is using 100% recycled electrons.
Some men see computers as they are and say "Windows"
I use computers with Linux and say "Why Windows?"
(Thanks JFK, for the insight.)