Tag Info

Hot answers tagged

21

There are two standard ways to build such a device: Time-based. The device has a secret key K (known only to the device and to your bank). When you press the button, The device computes F(K, T) (where T is the current time) and outputs it as a 6-digit code. Your bank, which also knows K, can compute the same function. To deal with the fact that the ...


21

This is not a "one is better than the other" issue. Both increase the burden of an attacker to break into your system: Using (and enforcing) keys increases the "quality of the password" ("mypassword123" vs "long_binary_asymetric_keypair_here"). Humans are very bad at remembering long passphrases with good entropy. Using 2Factor auth ensures that an ...


18

Passwords and biometrics have distinct characteristics. Passwords are secret data. Data is abstract: it flows quite freely across networks. Cryptography defines many algorithms which can use secret data to realize various security properties such as confidentiality and authentication. The shortcomings of passwords are due to the fact that they are meant to ...


15

Abstracted across a network, most biometrics implementations can still be boiled down to the category of "something you know". For a discussion of how that happens with "something you have," take a look at How is "something you have" typically defined for "two-factor" authentication?. Biometrics suffers from a problem where once a ...


13

I'm assuming that you mean for logon (or unlocking). I believe three factor is supported natively in Windows 7 with: Windows Biometric Service (requires attched device) PIV-compliant smart card (requires attached device) Password (Kerberos V5 for AD, and NTLMv2 for local) Windows Vista and Windows 7 have the same interactive logon architecture. They use ...


13

A weak password + two-factor authentication might still be safer than a strong password alone but it will be less safe than a strong password + two-factor authentication. It all depends on how weak you go: if you go all the way and make the password trivial you effectively end up with one-factor authentication (the Google text message to your phone). But ...


13

Specifically for Google, if you use two-factor authentication it is safe to "weaken" your password "from a 16-character password with a search space on the order of 1030 to an 8-character password with a search space on the order of 1014" as long as you use a good 8-character password (i.e. completely random and not re-used across sites). The strength of ...


12

Social engineering is hard to mitigate problem. Why? Because it's targeting the weakest security point of all system: users. So indeed, the more complicated the system is, the more complicated for attacker it gets. But usually, they get information because someone does not respect the protocol, e.g. sending confidential data by fax, giving information to ...


12

There are significant problems with all of these as a primary identifier. For example: Fingerprints/Palm - What happens if I fall off my bike and scuff my hand across the ground? My fingerprints are ruined for some time - possibly permanently. DNA - have you seen how easy it is to pick up blood or other material containing DNA? Typing - this has some ...


11

Google Authenticator supports the TOTP and HOTP algorithms. In both algorithms, a secret needs to be shared between the server and the client to successfully generate the one time passwords. I suggest you read the respective RFCs of the algorithms (or my answer here) to understand it better. Yes, if the attacker manages to get hold of the shared secret the ...


10

What I can say, generally, is that you should not have a single point of failure. Be it your mobile phone (can be lost, damaged, stolen), some other computer or device (can be damaged), a piece of paper (can be lost, damaged) or even your memory (can forget things, especially if not used too often). Just like passwords usually have fallbacks for recovery ...


10

The initial commit for this code already includes the "80 bits" secret key length. It was not changed afterwards. Now let's analyze things more critically. HOTP is specified in RFC 4226. Authentication uses a "shared secret", which is the value that we are talking about. What does RFC 4226 says about it ? Essentially, there is a a requirement in section 4: ...


9

We provide a two-factor solution at Duo Security which can use voice, SMS, mobile device, and hardware tokens. Our open-source web and unix clients may also help you evaluate your options (both ours, others, and towards rolling your own). Disclaimer, I am a Duo developer.


9

Although I have not personally used them, I have heard very good things from several sources about YubiKey, which is a tiny hardware key that's plugged into a computer USB port and basically provides a one time password which changes each time it is used.


9

I would recommend looking into PhoneFacter. I have looked at them in the past and found it to be a very interesting concept. Much like your bank they use telephones as the second factor, and offer either SMS or direct voice calls for verification. Whether they are "Cost Effective" will, of course, depend on what those words mean to you.


9

There's a few other reasons: Error rate - false accepts and false rejects are still unacceptably high for many types of biometrics. User acceptance - still not widely trusted by users - the various privacy concerns are still quite high, and the idea that a part of your body is now a security mechanism is somewhat freaky for some folks. Security best ...


9

My metaphor for social engineering is that it's like water - it will find the point of least resistance and work it's way in. When user's have two factor authentication, then you're right that you may seal up one point in the leaky dam of access to the system - I would hope that most users won't blindly hand over their token, and with the security ...


9

Put simply: cost. In this instance cost takes two forms, resource cost and monetary cost. Chances are great that if you have a computer or system of any type (desktop, server, mainframe, distributed, cloud, etc.) it has a built-in authentication mechanism: passwords. The time and money that it takes to bolt-on or integrate biometrics for average uses is too ...


9

If an SSH key is protected by a passphrase, then it's just encrypted with that passphrase. There isn't an additional authentication component. That is, you can decrypt the key client-side (and store the decrypted key), and the server won't ever know. In fact, many users use "key agents" which allow you to enter your decryption passphrase only once, and the ...


9

There are some explanations on what YubiKey does here. Basically, the password which the YubiKey "types" (from the point of view of the computer, it is a keyboard) can be either a static password, or a one-time password. If it is a static password, then you just revealed it, and it is time to be very sorry (and promptly change that password). The one-time ...


9

When authenticating humans, the main danger is impersonation: someone else posing as the expected user. Since humans are biological and not digital, there must be some link between the two worlds: something which ties the concept of the physical identity to sequences of bits on which computers can feed. We use multi-factor authentication because every ...


8

I started to ask this question to get input before discovering the one. In light of a Magistrate Judge's recommended judgement on PATCO v. People's United (which implies a horrible theory regarding multifactor authentication), I define something you have as this: What you have must only be compromised by an attacker having physical access to what you have. ...


8

Re. the question wether a paper based OTP-Solution could fullfill NIST 800-63 Level 3 requirement: From the source "... Authentication requires that the claimant prove through a secure authentication protocol that he or she controls the token, and must first unlock the token with a password or biometric, or must also use a password in a secure ...


8

Some good points are made at the Schneier on Security blog: RSA Security, Inc Hacked. The worry is that source code to the company's SecurID two-factor authentication product was stolen, which would possibly allow hackers to reverse-engineer or otherwise break the system. It's hard to make any assessments about whether this is possible or likely without ...


8

Assumptions. As I understand it, you are only concerned about eavesdropping: e.g., that the folks who are monitoring you might record everything you do, and fail to adequately secure those records. You are not worried that they will be actively malicious. For instance, they won't mount a man-in-the-middle attack on you. Advice. Given this threat model, I ...


8

Systems can fail, so you need a defense in depth approach. Bio-metric security systems rely upon fuzzing matching. They can suffer from whats called a type-II error, which means an attacker is successfully authenticated. Also Mythbusters has hacked it. (and they aren't the only ones.)


8

The many technical problems with biometrics are well canvassed above. Biometrics as a class still faces deep skepticism, and rightly so. Security professionals are conservative and cautious, and they find the following issues problematic: Very few of the technologies on the list above are commercially mature. I myself don't know why DNA, gait and smell ...


8

I have one, and I'd recommend them! I actually got it for free from the Yubico guys, when I was attending BSidesLondon. Think of it as an RSA secure-key, except much smaller, cheaper and without a battery. You get (essentially) the same security, though YubiKeys have a signficantly larger keyspace than the RSA ones. They're also incredibly sturdy, and can ...


8

Not really, at that point you are dealing with a compromised client and pretty much all bets are off. The best you can do is ensure the user is aware of the failure which will (hopefully) result in them asking questions or trying again. When a user connects the old user should be booted. This should make a legit user aware of the problem even if they ...



Only top voted, non community-wiki answers of a minimum length are eligible