Keylogging and phishing attacks can extract user identity

and sensitive account information for unauthorized access to users’ financial

accounts. Most existing or proposed solutions are vulnerable to

session hijacking attacks. We propose a simple approach to counter these

attacks, which cryptographically separates a user’s long-term secret input

from (typically untrusted) client PCs a client PC performs most computations

but has access only to temporary secrets. The user’s long-term

secret (typically short and low-entropy) is input through an independent

personal trusted device such as a cellphone.-Keylogging and phishing attacks can extract user identity

and sensitive account information for unauthorized access to users’ financial

accounts. Most existing or proposed solutions are vulnerable to

session hijacking attacks. We propose a simple approach to counter these

attacks, which cryptographically separates a user’s long-term secret input

from (typically untrusted) client PCs　a client PC performs most computations

but has access only to temporary secrets. The user’s long-term

secret (typically short and low-entropy) is input through an independent

personal trusted device such as a cellphone.