Timeline for IT will only give password over phone - but is that really more secure than email?
Current License: CC BY-SA 4.0
19 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 29, 2018 at 15:13 | comment | added | al45tair | Definitely easier to mine text data rather than voice data (though converting voice to text isn't beyond the wit of man). As for getting your hands on it, it's very situation dependent; in particular, if any of the traditional, low-tech approaches are an option, then it's really very easy compared to any kind of hacking/network-access-required situation. I tend to think the security of telephony is overstated and that of email understated because lots of us focus too much on the digital side of things and forget the old-fashioned stuff. | |
| Aug 23, 2018 at 21:35 | comment | added | Mike Ounsworth | @alastair Agreed. I don't think anybody here is arguing that it's impossible to eavesdrop on telephony, or that it's always possible to intercept email; just that in general it's easier to get your hands on and mine passwords out of email text data compared to voice data. | |
| Aug 23, 2018 at 12:38 | comment | added | al45tair | For non-VoIP cases, unless you're using special hardware, the audio is almost always sent unencrypted; you might point at e.g. mobile phones and say that there's encryption, which is true, but it only covers the radio part of the call. On the telephone network itself, it's unencrypted and can easily be intercepted by anyone with network access. Also, in the case of the "unencrypted email on the Internet could be logged", while technically true, the fact that the network is packet switched means it's often only practical for those parties whose equipment is necessarily in the data path. | |
| Aug 20, 2018 at 15:03 | comment | added | Luc | @ChrisH That's included in "Not leaving the premises": if you trust them with all your email in the first place, then it's not going to make a difference that they also do the internal transit of emails. | |
| Aug 20, 2018 at 12:09 | comment | added | Chris H | @Luc your assumption that emails don't leave the premises is sadly no longer true (even assuming the user doesn't download them from offsite). Here our email system is handled by Microsoft's servers; at the last place it was Google. | |
| Aug 17, 2018 at 1:19 | comment | added | user71659 | @IronGremlin I don't get it. SBCs are standard in any architecture when you leave the enterprise. If you got TDM, you got a media gateway. Asterisk is a B2BUA. If I make a conference call on Cisco CallManager, it automatically inserts a conference bridge transparently. When my softphone is off our LAN, it automatically tunnels through Cisco Expressway. When I call from my VoLTE phone, it sets up an IPSEC tunnel to the P-CSCF. When I hit hold on my phone, a SIP re-invite basically sets up a new call with the hold music stream... | |
| Aug 17, 2018 at 1:15 | comment | added | Iron Gremlin | @user71659 Because it's a pain in the ass to route a VoIP call over a proxy even if you're doing it as a legitimate and authorized proxy that both endpoints are aware of. | |
| Aug 17, 2018 at 1:07 | comment | added | user71659 | @IronGremlin And how are those different from intercepting e-mail in transit? It's all IP traffic. | |
| Aug 17, 2018 at 1:06 | comment | added | Iron Gremlin | @user71659 A VoIP attacker needs to have a pre-established presence to proxy the session, have access to dump an intermediary network interface, or is stuck trying to falsify one party and force a session renegotiation live. You need to have a fairly significant presence or a lot of set-up time to do that. It's certainly not impossible, but I'd call that a much more sophisticated attack, and most certainly one that's much more difficult to do without leaving evidence. | |
| Aug 16, 2018 at 18:40 | comment | added | Mike Ounsworth | @Luc As for mobile phones, my company also uses VoiP desk phones / software where I presume traffic for internal calls stays internal to the corporate network or at least the VoiP provider's network. | |
| Aug 16, 2018 at 18:32 | comment | added | Mike Ounsworth | @Luc Bit of a catch-22 there: when you reset your VPN password you get the new one over email, which never leaves the corporate network, which you need to VPN in to access. It sounds like the OP is sending emails to IT from outside the VPN and wanting the password to be returned that way. | |
| Aug 16, 2018 at 18:29 | comment | added | user71659 | @Luc Not in the US. My opinion is a desk phone is more comfortable to use, has better acoustics, doesn't use heavy speech compression, doesn't have dropouts. It's a far more professional experience. You also have issues when somebody needs to call 911, and with coverage, like an office in a basement. The US also, until a few years ago, had tax issues writing off cell phones. | |
| Aug 16, 2018 at 18:26 | comment | added | Luc | @user71659 Don't people usually use mobile phones instead of desk phones these days? I might be wrong, I haven't done a survey across thousands of companies around the world, but in my experience you usually get a smartphone issued with a regular number on a national network, and that's your primary phone number for the company to reach you. | |
| Aug 16, 2018 at 18:25 | comment | added | user71659 | @Luc If you assume internal e-mails don't leave the premises, an internal PBX call wouldn't either. The IT desk can do something like only call you at your desk as listed in the company directory. | |
| Aug 16, 2018 at 18:24 | comment | added | user71659 | @MikeOunsworth It's certainly harder to deal with speech recordings (paying somebody to transcribe on Mechanical Turk is an idea). However, if everybody is resetting at the same time of year, you can, for example, filter the SIP and recording streams for short calls to the IT helpdesk. | |
| Aug 16, 2018 at 18:23 | comment | added | Luc | Note that we are talking about a company here. Presumably internal email will never leave their premises. So yeah I point out that it's not always sent in plaintext, but for completeness, in this particular scenario it's actually likely that it is sent securely. Phone calls, on the other hand, almost always leave the premises since people usually only call via mobile phones these days (again, the case is different for internal VoIP or DECT, or in the case of CCC: GSM) | |
| Aug 16, 2018 at 18:09 | comment | added | Mike Ounsworth | @user71659 Fair enough. I have no experience in telephony. With text logs from email servers etc, it's super easy to ctrl+f for passwords. Assuming an unencrypted telephone network and / or VoiP packets, is it similarly easy to extract the password? | |
| Aug 16, 2018 at 18:07 | comment | added | user71659 | However, a lot of VoIP is transported unencrypted over LANs and the Internet. And on the TDM side of the phone network, there's no encryption or authentication whatsoever. | |
| Aug 16, 2018 at 17:49 | history | answered | Mike Ounsworth | CC BY-SA 4.0 |