Timeline for Would allowing the user to login via a set of IPs with face recognition be a secure enough alternative?
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 27, 2016 at 12:29 | vote | accept | Yates | ||
| Oct 25, 2016 at 15:33 | comment | added | makerofthings7 | @Dan I see our miscommunication. The camera needs to be tightly coupled with local authentication and the OS. The provisioning of this OS creates a local bit locker key. Windows Hello, in this case, provides security equal to a smart card. A web application can leverage this today on Windows 10 platforms. The IP address security is anecdotal. The support for this camera is broader than you think. Here is a year old article. windowscentral.com/… | |
| Oct 25, 2016 at 15:28 | comment | added | Dan | @LamonteCristo Entire buildings can have the same public IP, or a single computer in a house could; I don't think that's a reasonable assumption. Having a webcam at every station is viable, having the Intel one is likely not. And yes you're right in that at some point you have to accept you've done all you can against replay attacks, but that's one of the reasonings behind multifactor anyway. | |
| Oct 25, 2016 at 15:15 | comment | added | makerofthings7 | "restricting by ip address" seems to imply he doesn't need ubiquitous availability of the authentication solution. A "replay attack" with a camera is no different than a key logger threat in the traditional sense. A password can be observed by a 3rd party. Recently sounds of a key press could be used to recreate a password. In some cases a camera + 3d auth may be more secure. See "Windows Hello" authentication for more. | |
| Oct 25, 2016 at 15:10 | comment | added | Dan | @LamonteCristo That's wonderful, and maybe in future it'll be a bit more available. But firstly, how many people will currently have that at every terminal they want to log into? And secondly, I still wouldn't solely recommend it for logging in. Pointing it at the guy sat next to you or conducting a replay attack could still log you in. | |
| Oct 25, 2016 at 14:32 | comment | added | makerofthings7 | The Intel Real3D camera uses infrared, depth, and motion to prevent the printout scenario security.stackexchange.com/q/136161/396 | |
| Oct 25, 2016 at 14:03 | comment | added | Dan | @ThomasYates An office is not a public location. Neither is your home network. But in either case, a colleague, visitor, or random stranger that stumbles into the network can still make use of the IP to log in. Face verification should never, under any circumstances, be the sole credential for logging in. Adding an IP restriction reduces the attack surface, but feels akin to security by obscurity. | |
| Oct 25, 2016 at 13:18 | comment | added | Yates | And if the user is warned against using this method in a public location (let's say everyone in the world is smart enough to heed this warning), are there still too many risks against face verification authentication? | |
| Oct 25, 2016 at 13:15 | review | First posts | |||
| Oct 25, 2016 at 13:22 | |||||
| Oct 25, 2016 at 13:13 | history | answered | Dan | CC BY-SA 3.0 |