PayPal using security tokens

Security tokens have been used for quite a while now, and they are still very useful for enterprises. However, they are susceptible to man-in-the-middle attacks, especially when they are used for authentication over the Internet. This was shown a while back when Brian Krebs reported Citibank's problem with a phishing site that sat between the bank and client.

The site asks for your user name and password, as well as the token-generated key. If you visit the site and enter bogus information to test whether the site is legit -- a tactic used by some security-savvy people -- you might be fooled. That's because this site acts as the "man in the middle" -- it submits data provided by the user to the actual Citibusiness login site. If that data generates an error, so does the phishing site, thus making it look more real.

So now it looks like PayPal is going down this road as well (I got the link from Tom Olzak's post). I know the combination of the typical username / password with the token will probably increase security overall. And I know the Citibank phishing site was fairly sophisticated. But it is these big pay-off sites that will be a target for more sophistication in attacks, so I am thinking it won't be too long before a similar site pops up for Paypal.