meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 3 months |
| seen | Apr 2 at 15:48 | |
| stats | profile views | 8 |
|
Jan 30 |
awarded | Commentator |
|
Jan 29 |
comment |
Mutual authentication for humans Some good points, thank you. I think the person answering the call would typically issue the challenge anyway ("hey, you called me, so you prove who you are first"), but it's a good idea to make this part of the protocol. |
|
Jan 29 |
comment |
Mutual authentication for humans But how would the trusted third party be authenticated, ie. when you get a message saying "yes, authentication succeeded" how do you know it really came from them? Also, I don't understand what you mean by "use the password as a public key". |
|
Jan 29 |
comment |
Mutual authentication for humans OK, got it, thanks. I think that would work in software, but with a human "implementation" under less-than-ideal conditions I wouldn't want to rely on it. Even I probably wouldn't be so paranoid as to "fail" authentication because of a dropped phone call or other practical issues. |
|
Jan 29 |
comment |
Mutual authentication for humans That would be a nice bonus, but not essential. |
|
Jan 29 |
comment |
Mutual authentication for humans It would be detected next time unless I'm misunderstanding something, but by that stage the attacker has already succeeded at least once. Separate lists for the two people sounds like it could work around that. Do you see any issues with that approach? |
|
Jan 29 |
comment |
Can a sim number be traced to who topped it up by telecommunications if it was by credit/debit card? In theory, yes. In practice - you'd have to ask the company. They wouldn't give it to you, but maybe to law enforcement. |
|
Jan 29 |
comment |
Mutual authentication for humans Maybe the solution is as simple as having separate challenge response lists for the two of them, so that Bob would never respond to a challenge intended for Alice? |
|
Jan 29 |
comment |
Mutual authentication for humans Interesting, thanks, but could you elaborate on how to prevent replay attacks? Eg. this scenario: Mallory calls Alice Alice: Challenge 1 Mallory: sorry, bad reception, let me call you back Mallory calls Bob Mallory: Challenge 1 Bob: Response 1 Mallory calls Alice back Mallory: Response 1 Alice: Oh good, it's you, Bob! In this scenario Bob had no way of knowing Challenge 1 had already been used and Alice only used it once, successfully, as far as she can tell. |
|
Jan 29 |
awarded | Student |
|
Jan 29 |
asked | Mutual authentication for humans |
|
Jan 28 |
awarded | Supporter |
|
Jan 28 |
answered | Can a sim number be traced to who topped it up by telecommunications if it was by credit/debit card? |
