26

Quoting from CompTIA Security+ guide

The first factor of authentication (something you know, such as password or PIN) is the weakest factor.

Why? it makes sense when we say that humans/users are the weakest factor in any system from security point of view as we humans forget, make mistakes and break easily. But it makes no sense (to me a least) that getting kidnapped and tortured (in order to give up my password) is more likely to happen than me losing a smart card or a key fob?

enter image description here

45

In the typical case, something you are and something you have can only be true for one person at a time. If you lose your token, you know you have lost it.

Something you know can be copied by someone without your knowledge. If someone has your password, you may not be able to tell that they are actively exploiting that knowledge.

That is one reason to change your password regularly. It shortens the window where a password breach could be exploited.

  • 15
    Something you know is also the easiest to guess or otherwise obtain. Users can still make weak passwords and reuse them or variations on them. – Paraplastic2 Oct 8 '14 at 15:38
  • 3
    Something you know can be attacked at any time by anyone anywhere in the world. The attacker may or may not need to involve you directly when they obtain this information. On the other hand, something you own can be attacked only from one location on the entire planet, and you would need to make a significant mistake or suffer tremendous misfortune for such an attack to be successful. And of course, combining both forms just multiplies the probabilities of victimization to arrive at an even smaller probability of victimization. – Keen Oct 8 '14 at 16:52
  • 4
    Also, "something you know" can't be taken away. When you want to revoke access to someone, you can take away a key, but you can't force someone to forget the hardcoded master password. – Philipp Oct 8 '14 at 17:50
  • 2
    It shouldnt be forgotten tough that it is possible to reproduce fingerprints (something you have/are). In the case of the iPhone fingerprint reader it has been proven that a weak implementation (weak fingerprint reader) is not really stronger than a password on its own. In my book passwords are the best solution for humans to use and should be complemented by a second factor whenever possible. Ranking different factors against each other seems beside the point to me... – Sebastian B. Oct 8 '14 at 19:32
  • 1
    The key point is "without your knowledge". You know if someone steals your RSA keyfob or cellphone or one-time-use-pad — you don't know if someone steals your password or PIN. – Greenstone Walker Oct 8 '14 at 20:18
25

Passwords, or more generally something you know, are often relatively weak, because users cannot remember high-entropy secrets. As a result, passwords (or anything you need to memorize) usually ends up being a low-entropy secret, which enables random guessing, offline dictionary search, and other attacks. While it's possible to create and remember a pretty good password, experience shows that users don't -- and that it is probably unreasonable to expect users to do so.

There is a tremendous amount of academic research and practical experience that backs up this statement. Here are some example references:

In addition, any secret you know can potentially be phished (i.e., someone might be able to social-engineer you into revealing it).

Remember the classic statement:

Humans are incapable of securely storing high-quality cryptographic keys, and they have unacceptably slow speed and accuracy when performing cryptographic operations. (They are also large, expensive to maintain, difficult to manage, and they pollute the environment. It is astonishing that these devices continue to be manufactured and deployed. But they are sufficiently pervasive that we must design our protocols around their limitations.)

Charlie Kaufman, Radia Perlman, Mike Speciner, Network Security: Private Communication in a Public World.

At this point you might be wondering: Given the passwords have so many issues, why do we still use them? If so, I recommend you take a look at this question: Why do we even use passwords / passphrases next to biometrics?.

  • 1
    "It is astonishing that these devices continue to be manufactured and deployed." They're purpose generators. We can't get any utility out of our other machines without these components. But yes, they are terribly inefficient. I hope someone is working on a replacement for this outdated technology. – Keen Oct 9 '14 at 16:43
  • Strange that these fallible "humans" tend to produce devices that are so unlike themselves. Then they struggle to work with them! Perhaps they should have stayed with producing only other humans. But they are problematic to themselves also... – user82913 Oct 13 '14 at 18:19
8

It is possible to have a "something you know" which you cannot be forced to disclose. I read about a secure login system which presents a grid of 12 to 15 photos of faces, and you have about 3 seconds to touch the 3 or 4 that you have seen before. For this to work, there must be a database of many thousands of photos, and you train on hundreds of them. The system knows which ones you have trained on. (you give a user name first which is assumed to be "public" - not secure.)

You cannot possibly convey this info to another person, and any success in one login conveys zero success in another. For "something you know" to be effective, we should simply use aspects of human nature that work effectively. Most people can recognize previously seen face photos - it is built in.

  • 1
    @PwdRsch: You would need to train the attacker so that they could answer the challenge in 3 seconds when it was presented. For that, the attacker would need the entire database of faces. New faces could constantly be added with no difficulty, confounding any efforts to "teach" it to someone else. Similarly, faces that you know could be removed. If you "disappeared" (presumably you are actually performing work if you have such a high-security login) then your entire user ID and set of faces could be marked as compromised, aiding the search for you. It is simply impractical. – user82913 Oct 8 '14 at 18:39
  • 3
    It seems interesting, but I don't understand. The database has many thousands of faces and I train on hundreds of them. So I am supposed to remember several hundred faces and if I forget a face I can't login (or at least I have to retry). – emory Oct 9 '14 at 0:35
  • 3
    Assuming you are presented with 15 faces, must choose the 4 you know, the subject logs in almost every day, and that the system locks up after 3 failed attempts. A patient attacker could reasonably expect to make the first unauthorized login through daily random tries in about 4 years. If the attacker is collecting the faces, then each login attempt (whether failed or successful) provides the attacker with useful information for the next login attempt. It is viable if there is a lockout for repeated failure and new faces would need to be added at least annually. – emory Oct 9 '14 at 0:58
  • 2
    @NoComprende I think a critical problem is that it is hard for me to validate what you know without me also knowing it. With the faces, the database knows which faces you have trained on. When the attacker manages to steal the database, the system is critically compromised. In classical password authentication, the system does not know your password. – emory Oct 9 '14 at 13:24
  • 2
    Maybe we should add a security category: Something Nobody Knows : ) Totally airtight. – user82913 Oct 9 '14 at 13:31
8

This is the result of the excellent marketing done by biometric authentication vendors.

"Something you are" is sometime very easy for an attacker to reproduce, fingerprints and voice are especially easy to obtain, without the possibility for people to use credible strategies to avoid it (wearing gloves at all times and not speaking in public is not practical).

Most of us likely leave dozens of exploitable fingerprints everyday, I for one don't say my password out loud nearly that often.

"Something you have" is not without faults either, and requires a great deal of user education to be used properly. E.g. in any RSA SecureID company, a tour of the office will reveal many of them on desks, the code being visible. I even saw people carrying them around their neck with them. Also the disappearance of an authentication token may not be noticed until it is needed.

  • "something you are" is however more complex to reproduce than a mere password / PIN, and depending on its nature potentially volatile in existence. And there is of course also the "something you have", a difficult-to-clone piece of hardware – Tobias Kienzler Oct 9 '14 at 9:28
  • In the case of fingerprints they are trivial to reproduce, as in, kid workshop trivial. The gummy bear paper (cryptome.org/gummy.htm) is now 12 years old and should be common knowledge by now. Most other biometric technologies can be fooled too. – Bruno Rohée Oct 9 '14 at 10:24
  • 1
    At a certain point it might however be easier to simply bypass the scanning mechanism itself. Nonetheless I agree that biometric isn't something one should rely on (at least not exclusively) – Tobias Kienzler Oct 9 '14 at 10:36
  • 7
    Biometrics are identification, not authentication. That the conjunction of good marketing and "innocence" of some decision makers led to biometrics being used to authenticate people is really a failure of our industry. – Bruno Rohée Oct 9 '14 at 10:43
  • 100% agreed upon – Tobias Kienzler Oct 9 '14 at 10:45
1

The biggest (and only) problem of password based authentication is that its strength is set by the user, and there is a strength-usability tradeoff. In theory, passwords have lots of great properties for an user: they are hard to obtain from third parties by force, you don't leak them everywhere like biometric data, they can be stored as hashes unlike biometric data, users can stay anonymous to the service (if you share your mobile phone number for 2 factor or give them your fingerprints you lose that), users can tell the password other people, and share access. Try that with biometrics, or key fobs. So passwords offer more control to the user, which can be an advantage, but most times is a disadvantage.

Then there are problems in implementation. First you need to set a completely distinct password for every place you have to use a password. This is because most times the other party gets your password in plaintext. When you use a strong authentication scheme like SCRAM-SHA1, you never transmit the password to any third party, and can use a scheme like "strong password" + "website name" for your password. This usage of passwords however is very unclear to separate. You can create a small device where users enter their passwords into, which guarantees that the password never leaves it, but the user can be spoofed by the computer and think they have to enter it there. There it is again, the strength relies on the user.

  • 1
    Anonymity wouldn't have to be any worse with a key fob than with passwords. If a user can select a desired initialization vector for whatever sort of hashing algorithm the fob is using, the same fob could serve any number of different accounts without the generated codes being recognizable as having come from a single fob. Further, suitably-designed key fobs could offer more security with regard to passwords, since it would be possible to have one key fob give another key fob information it could use to say "I am Y. Here is proof that X said Y should have access to X's account until May 3". – supercat Oct 10 '14 at 17:52
  • I wish more systems would provide a means by which a user "fred" could easily ask for the creation of login ids "fred.1", "fred.2", etc. which would have some specified subsets of abilities and independent passwords, and which could easily be enumerated by, and individually revoked by, the owner of account "fred". – supercat Oct 10 '14 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.