Return to Answer

edited body

Source Link

edited Jul 29, 2016 at 7:12

2.1k
10
11

You already stated, that this is overkill. I suspect you will anoy the user. All your factors are knowledge factoresfactors. Drawing a line in a grid. Identifing the numbers according to the known line. Answering knowknown facts about me.

So as far as I understand you are combining several different kind of knowledges. But the idea about two factor or multi factor authentication is not to ask for two or multiple passwords but to required different authentication types. Why? Because andan attacker is not good in attacking all different kinds. I like to talk of the skill profile of the attackedattacker. If an attacker can crack your 8 character password he can as well break two 8 character password. But he might not be able to steal a realmreal possession.

You want to create a new formula for each user? Why that? Are you a professional cryptographer? You should use RFC4246 or RFC6238. These are RFC and standardized.

I recommend to take a look at a solution of mine privacyIDEA. I am not a cryptographer so I do not invent new formulas but stick to open standards. Nevertheless the user can use TOTP, HOTP, smartphone, hardware, yubikeys, questionaire...

You already stated, that this is overkill. I suspect you will anoy the user. All your factors are knowledge factores. Drawing a line in a grid. Identifing the numbers according to the known line. Answering know facts about me.

So as far as I understand you are combining several different kind of knowledges. But the idea about two factor or multi factor authentication is not to ask for two or multiple passwords but to required different authentication types. Why? Because and attacker is not good in attacking all different kinds. I like to talk of the skill profile of the attacked. If an attacker can crack your 8 character password he can as well break two 8 character password. But he might not be able to steal a realm possession.

You want to create a new formula for each user? Why that? Are you a professional cryptographer? You should use RFC4246 or RFC6238. These are RFC and standardized.

You already stated, that this is overkill. I suspect you will anoy the user. All your factors are knowledge factors. Drawing a line in a grid. Identifing the numbers according to the known line. Answering known facts about me.

So as far as I understand you are combining several different kind of knowledges. But the idea about two factor or multi factor authentication is not to ask for two or multiple passwords but to required different authentication types. Why? Because an attacker is not good in attacking all different kinds. I like to talk of the skill profile of the attacker. If an attacker can crack your 8 character password he can as well break two 8 character password. But he might not be able to steal a real possession.

You want to create a new formula for each user? Why that? Are you a professional cryptographer? You should use RFC4246 or RFC6238. These are RFC and standardized.

Source Link

created Jul 24, 2016 at 20:19

cornelinux

2.1k
10
11

So as far as I understand you are combining several different kind of knowledges. But the idea about two factor or multi factor authentication is not to ask for two or multiple passwords but to required different authentication types. Why? Because and attacker is not good in attacking all different kinds. I like to talk of the skill profile of the attacked. If an attacker can crack your 8 character password he can as well break two 8 character password. But he might not be able to steal a realm possession.

You want to create a new formula for each user? Why that? Are you a professional cryptographer? You should use RFC4246 or RFC6238. These are RFC and standardized.