billc.cn

It's not really "impossble", just computationally infeasible. Given the infinite number of files that will hash to a given SHA256, it's technically infinitely possible.

@AstroDan Most sensible banks use a user name dedicated to online banking (some even assign these randomly), so there's nothing to brute force unless the customer reveals this info somewhere other than the bank's website. Many also use dual passwords with a delay after the first one, so a real user who knows both passwords can get in reasonably quickly, whereas an attacker will not have a chance to test enough passwords before the bank take action.

Another possibility is radiation source, but I am not sure how you would verify or defend against it....

@k1308517 Is the device connected to the terminals of the meter or simply attached to the case? Do you know the rough dimensions of the device? Is the device powered in anyway?

@k1308517 Are you absolutely sure the attacker actually crashed the processor in the computer instead of say jamming the communication lines or the reading mechanism?

@almosnow You said "3. The client has access to an input field where they load their key file." All an attacker have to do is to change the script and upload the file to the attacker's server.

No cryptography using client-side JavaScript can be secure without HTTPS. Any MITM attacker can send JavaScript that can do anything with the secrets the browser has access to, then there will be no secret.

@John Read the tutorial I linked. I thought the "at home" description I added was already a hint...

@John The technology you said in "would not work" point 1 already exists (see EAP-SIM and EAP-AKA) and is widely-supported by recent iOS and Android devices. Commercial deployments already exist in Spani and the UK. There are even tutorials on how to set it up at home.

@Tloz Since you've mentioned you're French, is there any chance the NGO is also French? If so, it would be bound by the local implementation of the EU Data Protection Directive under whcih transmitting personal data like addresses in plain is potentially illegal.

@SteveSether Do report back in one year if you get any swatting, hate mail or shit posted to your address. See krebsonsecurity.com/2013/07/…