What are the advantages of multi-level authentication?

Question

By multi-level authentication, I am referring to the fact that the user makes use of a primary username password keypair to log into his account. Then, to perform some other actions, such as authorize a transaction, he is required to reauthenticate himself by providing a secondary password or passphrase.

So, what are the advantages of multi-level authentication? The only advantage that comes to my mind is that in case a user left his account open by mistake or someone knows the primary username and password, then they won't be able to do anything.

However, what about phishing, keylogging and man-in-the-browser attacks? Am I right in saying that multi-level authentication provides no security at all against these types of attacks? Thank you very much :)

Answer 1

If all authentication is done by typing passwords into the same device (your desktop client) - then, yes, key stroke loggers are still going to be an issue. Keep in mind that when you separate authentication systems, you open up options to go to multifactor authentication, as well - if not now, then in the future - where you could use tokens, separate key pads, etc. - which could limit a simple key logger's ability to get the high privilege access.

Man in the middle - if the man in the middle is in the middle for both levels of authorization, then yes, that's an issue. But most times I'd have been surprised to find that both took the same path. So if you're talking about web browsing, then possibly. But if it's access to the host, then access to something on the network - you may be talking about two paths, and the man in the middle would need access to both.

Social Engineering (including phishing) - Usually multilevel authentication comes with multilple rounds of training. In the case of an admin account and a regular employee account, the employees usually get a long boring training session on the importance of security, which may or may not be effective. Quite often admins with high risk accounts, are given a secondary round of training that is more pointed, and more along the lines of "mess this up in a big, careless way, and you'll be fired". By giving and separating the password, it's often easier, administratively, to enforce this.

Other advantages:

Separate security processes - with two levels of passwords, there's an option to let the low level password store compromise on the side of availability while the high risk password store tends towards privacy. For example:

• the low level may provide federation services, remote access, services that support non-company devices, etc. The high level store may require physical access to the building, encryption capabilities that aren't available on all devices, and higher-grade password quality.

• separate storage - both live and in backup and in logging. A high end system may require encrypted tape backup, securely stored audit logs for a certain period of time - being able to totally separate the infrastructure can be very helpful here. High end storage is expensive, so less to store is a big win.

• access monitoring - live monitoring of access attempts - a system far in the front of an infrastructure may invoke so many brute force attempts a day that you don't worry much about it until it becomes a DDOS. A system nested deeply inside the infrastructure may be of serious concern every time the intrusion detection raises a flag. Access monitoring may be staffed differently, monitored differently and reacted to differently.

I could probably dream up a few more.. but most of what I come up with as BIG wins are from a large scale organizational perspective where the focus is not just on the single user and their end machine, but on the system as a whole, and the need to trade cost vs. risk.

Answer 2

Needing an additional password to authorize critical operations is a nice addition to the usual username+password credentials. Let's break down the risks based on your fears.

• Phishing - Additional passwords keep their effectiveness only if they do not get phished along the main one. Sadly, users inserting all of their 30 operative codes in a single phishing page is not unheard of.
• Keylogging and Man in the Middle - If the application requires a single additional password, than an attacker getting ahold of it will compromise the account. Otherwise, if there are multiple passwords, then the attacker will have to acquire enough of them in order to be truly effective.

A single additional password doesn't provide much of an improvement over security, but it's still a welcome feature. In order to raise the whole authentication security, a second factor (e.g. a token) is a way better option. If adding a token is not possible, then multiple additional passwords are the next best thing.

Answer 3

I'll just add this because it hasn't been mentioned yet:

Requiring re-authentication to perform special actions (the archetypal example would be changing one's password) can protect against CSRF attacks.

Say you were chatting in our chat room here, and I posted an image such as:

<img src="http://example.com/change_password?new_password=1234" />

Your browser would visit that URL, and pass upstream whatever cookies it has, including your session key. If a simple GET request was all that example.com required to change the password of the currently logged-in user, then your password would be changed without your knowledge. All you would see is a broken image in the chat.

Adding re-authentication such as:

http://example.com/change_password?current_password=abcd&new_password=1234

Makes it impossible for me to generate the URL without knowing your current password.

Answer 4

This would not protect you if the attacker managed to get the password, just like any other types of password protected authentication.

It does add a nice extra check, I like these kinds of checks when thing like purchases are made. The PSN (Playstation Network) has this as an option to prevent other people making purchases from the store and from making other account changes, this is optional but can be a good way to secure things.

Answer 5

If the username and password is different for the higher security action and the action is rare, then it greatly reduces the surface area to attack the secondary credentials since they are used less often. It would be far easier for example to set up a phishing site for the main login, but far more complicated to keep them believably on the phishing site until they get to the secondary login for the secure activity.

Note, it could still be possible, but it raises the technical bar considerably. It also offers the user an option to avoid using their secure password on untrusted systems. Say for example I wanted to log in to my Google account on a public system to access my GMail. It would be nice if I could have a secondary password for my Google Wallet so that if the machine I'm accessing GMail on is compromised, the attacker can only get at my e-mail rather than my finances.