2

I became aware of Trusona recently (see their demo on this page https://www.trusona.com/ ). They want to 'end passwords'.

I believe in the idea that 'reasonable security' = {something you are + something you know + something you own}, and that anything else pretending to be safe enough is basically unsafe / a lie.

From my point of view it looks like they use some image analysis to check that an ID has been shown, and shown in a way different from any previous image of this ID - to check somebody did not steal the logging image used as credential. So this is the 'something you own'.

But do they have any way of checking that the logging ID is valid in the first place? I guess if you obtain a snapshot of an ID, you can as well print it and re-scan it?

So how can a system like trusona be secure at all? Is there something I am missing? I do not see the 'something you know' / 'something you are' components of safety, and the 'something you own' itself seems dubious compared with a good cryptographic pseudo random number generator.

In a sense, this is the same reason why I would not use pure fingerprint ID ('something I am', but easy to copy) for anything serious - I am giving my fingerprint for free hundreds of times a day each time I use my fingers. At least as long as you cannot read my mind / hack my end-point access, you cannot get to my password (not to say there are no ways to do both of course).

Am I missing something / can somebody explain if / why trusona is actually safe?

Improve this question
3
  • Your password can be captured through MitM methods, as long as the attacker either has the keys to the encryption method you're using, or you're sending in plaintext already. – xorist Oct 3 '18 at 17:56
  • Yes and no. If you use a RSA like protocol, then interception of the communication is no information. Luckily enough I would hope that no just-a-bit-serious application would send unencrypted passwords or any other info over the network... – Zorglub29 Oct 4 '18 at 15:42
  • I mean there's plenty of tactics to bypass the security SSL provides. SSL forwarding proxy for example.. But regardless of what method you're using, if the attacker has the keys to your ciphertext they're going to be able to read the plaintext, it may not always be required to "read my mind or hack my end-point" in order for an attacker to get my password. – xorist Oct 4 '18 at 15:52
2

From the demo, it looks like they've built something pretty similar to every other PAM platform, except that it uses a smartphone camera and an app to perform the validation. The use of a driver's license in the latest version is a cute add-on, but it will probably meet with user resistance.

Based on what I saw in their videos, the basic architecture looks like this: users establish their account with a third party validation provider (Trusona) and install the app, which is linked to the account with a certificate pair. When you attempt to log in, a push notification is sent to the phone associated with your account and you take a picture of a one-time password in the form of a QR code. The app verifies the OTP with server and logs you in, fulfilling the "something you have" and "something you know" roles with the phone and QR code, respectively.

This isn't any different than any other PAM system, really. So as far as security goes, it's pretty okay. You're right that in an ideal world, you'd have three factors for authentication, but for the vast majority of people, this type of two factor centralized authentication would be fine. I wouldn't be terribly surprised to see Trusona or another similar platform popping up on more sites moving forward.

The largest issue I have with it is trust with the third party. If you look back to the RSA breach in 2011, you can see the kind of problems having a single large third-party validation system can have. When the SecurID seed was stolen, it became possible to generate valid credentials on the platform, bypassing the proposed security. Trusona could easily suffer the same fate, but then again, so could any other authenticator.

Improve this answer
4
  • I understand while there is 'something you have', but not why there is 'something you know' involved in the process. Also, how can a scan of an ID be considered as 'something you have'? This sounds too me far too easy to fake - compared for example with a cryptographic pseudo random number generator, where you never get access / communicate the internal seed / state, you communicate the full 'something you have' when you send a scan of it? – Zorglub29 Oct 3 '18 at 17:35
  • In this scenario, the QR code is the "something you know" the same way that a OTP is "something you know". Granted, you could reasonably argue that it is more like "something you have", but the effect is the same: you're using a multichannel authentication scheme to validate the user's identity. As far as the ID scan, the presentation made it sound like they were using photographic variation of the object as proof that the object is actually in possession. Similiarly to how you never sign your signature exactly the same way, you also never take a photo exactly the same way either. – BaselineSec Oct 3 '18 at 17:38
  • Yes, but you can certainly print and then re-scan the ID, or use any other technical trick to provide a copy that is slightly different isn t it? Does not sound secure. Ok, this is where the 'something you know' is. To me it sounds more like 'something you have'. – Zorglub29 Oct 3 '18 at 17:42
  • There will always be ways to defeat security systems. That is why we continue to design new ones. The important thing to consider whether the cost of the attack is commensurate with the gain. This system isn't protecting nuclear launch codes or proprietary industry data, it's geared for consumer grade websites and social media. Ostensibly, you could use it in a business, but it's competing against dozens of proven platforms. In any case, is the information gained worth the effort of stealing personal property? Probably not, cellphones and licenses are very visible targets. – BaselineSec Oct 3 '18 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.