2

Does anyone have any examples of real-life applications that doesn't require "strong authentication". I am looking specifically for blog posts or even scientific papers that argue that "strong authentication" is not required for all applications ... sometimes you need to authenticate users using IP addresses only, for example, but anything more than that would be unnecessary ...

EDIT: Ok, I think I need to explain myself a bit further. I am looking for an argument from a developer or a business owner or a scientist (an official statement, e.g. scientific paper, or semi-official, e.g. blog post) that argues for a "non-strong" authentication. The business owner's insight is the most important thing (that I'm looking for). For instance, @Florin Coada's example is great, but it would be better to see Apple's insight on the matter. I tried googling for days, but keywords I'm using are bringing completely irrelevant results.

EDIT 2: The answers are awesome, and maybe I should extend the question a little bit (for the last time). Would there be any kind of application, where the risk of "security breach" is high, like privacy breach of users of your service (by "power users" like skilled programmers), yet you choose to do a "weak authentication"?

|improve this question
  • A while ago I worked on a project that exposed an API and didn't require any authentication ... the caveat was that the few customers who used that service connected via VPNs and it was on everyone's benefit not to abuse the API. – HocusPocus Aug 26 '14 at 21:30
  • Giving access to a university's cafeteria, where you only need to guarantee that an individual is likely a student, and you can suffer some level of externalities incurred by false positives? – Steve Dodier-Lazaro Aug 26 '14 at 22:40
  • egress filtering? NIST 800-53 AC-19? Actually I'm pretty sure you'll find what you're looking for if you look at advertising networks - they need to 'authenticate' users at the weakest possible scheme. – Mark C. Wallace Aug 27 '14 at 10:33
  • @MarkC.Wallace, I will check them as soon as possible. – FearUs Aug 28 '14 at 1:13
3

Protections are in place to combat risks. If the risks are low, then the protections can be low.

Think about a forum site. There might be no reason for the site to use "strong protection", because all you really want to do is to be able to identify who is contributing. It could be determined that the site needs very weak protections in that case.

The answer to your question is in the risk analysis. Provide the appropriate protections to combat the risks you identify.

Edit post Clarification:

The business owner's perspective is based on a risk calculation. What are the risks if someone is misidentified, what are the costs if such a risk is realized, and what is the cost to put in stronger protections to reduce that risk? If the costs to reduce are greater than the cost of a realized risk, then it is not cost-effective, from a business point of view, to introduce the stronger protections.

ISO 27005 provides this risk management framework.

|improve this answer
  • Please see my comment on @Florin Coada's post. – FearUs Aug 26 '14 at 23:51
  • Would there be any reason where there is a high risk, namely privacy breach, but no need for "strong authentication"? – FearUs Aug 28 '14 at 1:17
  • @FearUs Yes, of course, if the costs of implementing strong auth are greater than other controls that can address risk equally well, or better. Maybe the risks can be mitigated, maybe you can transfer the risk to a 3rd party, maybe you can adaptively correct for problems if a breach occurs. Etc. – schroeder♦ Aug 28 '14 at 2:19
2

What you are describing sounds a bit like the Apple student discount. In order to purchase something with a student discount you have to log in from your university network.

Edit:
The reason for them to do this is that they do not want this to be available for everyone (captain obvious to the rescue).
I think they used the university network to identify people because people generally need to log in to those networks.
This would mean that by being on the university network they are logged in with their student credentials from that university. This would make them students (and others) at that university, thus eligible for the discount.

The important thing to note here is that there is another level of authentication before the IP authentication done by Apple.
End of edit

This post here: http://www.mikewilson.cc/2010/08/18/how-to-get-a-15-discount-at-the-apple-online-store-from-your-own-home-youve-got-to-be-a-student-though/ briefly describes this and also explains how he managed to bypass that authentication.

Probably because they realised how easy it is for people to get a 15% discount they have opted for something call unidays. I have no idea how that works, but this is one example for what you were asking.

|improve this answer
  • Well, yes and no. In fact, I was hoping for a argument for "non-strict authentication" from a developer or a business owner's point of view. I mean, I need an argument for it. – FearUs Aug 26 '14 at 23:50
  • The argument behind low security is always that there's nothing of value at the other end. If someone "breaches" your security fence they will not get anything that will do harm to the business. What are you trying to protect with the low level of authentication? If you can answer this then we can probably come with more reasons why you don't need to invest too much time/resources/money in this. – sir_k Aug 27 '14 at 8:50
  • 2
    This is actually an argument for attribute based access control - the relying party asks for and receives a weak attribute proof. – Mark C. Wallace Aug 27 '14 at 10:30
  • @FlorinCoada "low value" is never a good metric. The calculation needs to be based on risk. Even if the target has 0 value, there can still be risks if the breach exposes other vulnerabilities (access, correlating information, etc.). – schroeder♦ Aug 27 '14 at 16:00
  • I agree that risk is one of the main reasons. But, would there be any case where the risk is high, namely possible privacy breach achievable by "power users" (e.g programmers, hackers, etc), but you still choose to do "weak authentication" ? – FearUs Aug 28 '14 at 1:20
2

I have read your clarification. You might find a compelling argument in the following paper:

In general, where the party who is in a position to protect a system is not the party who would suffer the results of security failure, then problems may be expected. [1]

I.e. the "there is no need to invest in security for us"-argument. You might even pull this argument further to "there is an advantage for us, not to use strong authentication". Ease of use for the end-user, so you end up with more users might be an example of that.

[1]Anderson, Ross. "Why information security is hard-an economic perspective." Computer Security Applications Conference, 2001. ACSAC 2001. Proceedings 17th Annual. IEEE, 2001.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.