Slashdot Mirror
AOL Moves Beyond Single Passwords for Log-Ons
ars writes "Yahoo is reporting that AOL is adding a new feature alowing customers to use two passwords to log on. The second password comes from a small small device from RSA Securitywhich displays a new password each minute.
The scheme is called two-factor authentication and will cost $1.95 a month plus a one-time $9.95 fee. It's aimed at small business and people who conduct large transactions online."
I tried it...it was slow, often down, and required special software. None of which my cable connection is subject to.
Support more choices in goverment-Vote 3rd party.
Yes, i always wanted too pay to have a longer login time. so bad i'm not using AOL...
Can I have a $2 discount???!??!
;)
^^ Average american reply if this gets implemented.
Have fun at the aol sales desk
Mod me down im a newf (wiki)
Used to have to use them, smartID or something. ALL internal accounts were locked... its a very secure system, but hard to believe that users would actually want to use it.
Something I've waited for years and it never come--maybe someone can explain why: client-side SSL.
To my understanding, you would place a client-authenticating certificate in you web browser program, and during the SSL negotiation that certificate would be used for authentication.
The only two problems were (again, to my limited understanding) first that you had to go through the effort of installing the certificate on every browser you used, and second, the security could be broken if someone had access to your account. (Of course, account login security and browser "first-time-on-launch" passwords helped protect against that.)
Why the bloody SecureID system that's so klunky?
Murray Todd Williams
Interesting... this particular feature has actually been a part of AOL for several years now. All AOL employees are issued SecureIDs and are required to use them to log in to various places. It seems they've just expanded the feature to non-employees.
because it costs money.
"Identity theft only happens to other people"
AOL/TW employee's use these so why not offer it to customers, imho if banks gave out these devices for a one-off-fee on-line banking would be ALOT safer and there'd be less scams.
:)
Also sometimes those secure ID devices can go out of sync with the server and thats when the fun begins
Thats the only problems I've seen with them,
--
"WebTV: bringing the Internet into the shallow end of the gene pool since 1995" - Martin Bishop
These are the same devices the internal AOL employee accounts have been using for years.
SecureID.
e cu reid.pdf
Whoo.
Been there, done that.
All it does is make an attack "more" difficult, but nowhere near impossible:
http://www.tux.org/pub/security/secnet/papers/s
When common folk's computer is still infested with adware/trojan/god-knows-what
This just creates an illusion of security.
like most technologies, this one will never be embraced unless the pr0n industry stands behind it. They've been early adopters on almost everything else that's been successful.
For a company I worked for. It worked great, but they ended up scrapping it. Not sure why. I still have it sitting in a drawer years later still spewing numbers.
I suppose if someone was out to get you then they could steal the ID code generator.
Great, now phishers will have to ask AOL users for their password twice, and they will gladly comply.
AOL rip your card off by another $60 every year - saves small business the time and trouble of going out and finding a genuine internet criminal to perform that vital service.
No wonder they are America's number 1!
Beep beep.
This is going to be a complete waste of time IMHO. The AOL user base is such that a typical AOL user has a password like " password" or MikeJohnson". How do they expect users to be able to handle a second password that is strong? " I forgot my password, can you help?" Yes, just read the display on your password generator." "ok what does "dgR23Ls12S" have to do with me? My name is Mike Johnson"
I am glad that someone like AOL has taken it up to push this out and make it in broad use. Even if most AOL users simply ignore it, this could give it the publicity it needs to make it more known so other companies who need it can use it.
This is a good idea, 2 factor authentication (something you know - password, something you have - RSA gadget) should be manditory for serious transactions. I have seen this things before, they are simple, small, rugged and do not need to be interfaced with the computer so that they can be used anywhere without special hardware.
Even if you have sniffed, bribed, or tortured your way into knowing the password, you will not be able to log on unless you also have the gadget - its a good solution.
sheep.horse - does not contain information on sheep or horses.
For the tin foil hat hearing folk you can get a three password login for one low fee of 5.95
The RSA keys have been avaliable for a long time. They're great.
I'm impressed that AOL is using them. It shows that they're at least a little concerned with security.
I really hope that this is a starting point for web hosting providers to start using these.
rejected (19) accepted (0)
Is there a psychological term related to getting your stories rejected on slashdot?
IIRC, The RSA devices that I've used in the past rely on accurate time synchronization with the server. While it was easy for me to have it reset, I wonder how they plan to handle this on a large scale? It would require the end user to physically send the device back to AOL.
I suppose eventually they may integrate GPS timing with them, making it a thing of the past, but who wants your fob tracking you...
RTFA you nincompoop... one of the passwords changes every minute, and it's generated automatically. So phishing attempts would not be all that successful.
My bank uses one of these for online banking, as a protection against keystroke recorders. I suppose I'm just too lazy to actually get hold of one and try it. I figure they're not a bad idea, given that the majority of people trying to hack your accounts are amateurs who would be put off by it.
Other than that, Mrs Lincoln, how did you enjoy the play?
This could be the next step in security. It may stop outrages like this from happening!
These people aren't techheads, and most of them write their passwords down on pieces of paper, conveniently attached to their laptops, which is then conveniently placed in their work briefcase, along with the password updater.
Sufficed to say, dozens of these briefcases get stolen, in the same bar frequented by employees of this company every six months (One might ask why they still take their gear there). The thief gets an expensive company fleet laptop, a company password list, and a company satellite password updater, all packed in the same convenient suitcase with a carryhandle ready to go missing.
Ultimately, no matter how many security measures you put in place for a company or organisation, you're going to encounter people who write down their passwords, people who fall for emails from tech support who need to 'verify' their accounts and ultimately people who will have their information stolen and not report it for days, which is plenty of time for the thief, and a less-than-ideal amount of time for people like you and me to have enabled compromised accounts running on the system.
Had this ability for corporate accounts for some times. And the problems have never been addressed, some of which:
...
1) Long dial in times result in the 2nd password changing before completion, thus requiring a 2nd attempt (or a 9th, depending on how pathetic the phone service is)
2) Annoying easily lost dongle on your keychain that says "RSA- STEAL ME" in big bold letters.
So yeah, I'm thinking it's a great step. But not for AOL.
This is a great feature to have from an ISP, and the technology is sound (we used similar "Crypto Keyfobs" when I worked at PacBell for logging into the system remotely when in the field)...but I must admit I am surprised that it's AOL offering this kind of a thing.
I used AOL years ago, and have used it from time to time recently on other people's computers, and there is nothing in the "AOL package" that I have seen that says "power user" to me.
So I guess what I am wondering is...is this something that AOL users are actually clamoring for....or has AOL finally sucked up all the "n00b" market that there is and is trying to offer services that would appeal to more of the "slashdot crowd"?
How long until the AOL service department implements a policy for allowing users into their accounts when they've lost the SecureID, or their spouse accidentally took it with them, or they're on a business trip and left it at home? I see this being a perfect route for social engineering of unauthorized access.
+++ATHZ 99:5:80
They're hard pressed to remember their own password, and whine about having to enter that. Now they want them to carry a secureID card, and enter 2 passwords? Can you say marketing fiasco?
secureID works when you can FORCE employees to use it, but having people PAY for it Nah....
I obviously can't steal your RSA token without you finding out pretty soon.
Okay... I'll do the stupid things first, then you shy people follow.
[Zappa]
Get a clue, dump Microsoft while you still have money in your account. If you don't, Microsoft will charge it out of you on the next upgrade or hackers will just take it straight out of your account.
yes, they drift. not much, but a bit: this is why the system accepts a few numbers in the sequence. should it drift *too much* then you just need to phone their access control guys and get it put in "new pin mode" remotely. this happens all over the world, all the time. gps timing and tracking? lay off the crack.
What happens if I lose my SecurID?
Seriously. If I set my password to "password" and someone picks this up then I'm screwed, right?
Get your Unix fortune now!
The big question is, is AOL's true motivation for offering this to regular customers just to compensate for the service's renowned terrible security?
Part of the hardcore faithful who believed in Apple long before it was cool again to do so
It's aimed at small business and people who conduct large transactions online
Just a comment (read opinion), but unless you have no other options, why would you, as a small business owner, use AOL to "conduct large transactions" online.
Mod me troll if you like, but I don't consider AOL to be a very "business friendly" organization.
...also includes implementing ideas like the two-factor authentication for users who re-use their passwords, or write them on stickies, or lose their smartcards once every two weeks, or are simply computer-illiterate, etc.
What does AOL hope to accomplish through using the smartcard? A better investment in security would be to stem the flood of spams currently coming out of their slice of TLD. This measure is like a new bandaid for the old bandaid that's falling apart, and the wound is fourteen inches long and gushing blood.
AOHell Commercial
Chris
Many places are beginning to realise the value of passwords in protecting data, though one would have thought it would have been just as obvious in the past.
My college, the University of Florida, recently instituted a new rule that our school password had the be 12 or more characters long and have two of these three things: Capital letters, Numbers, and non-letter Characters.
Additionally, the passwords were checked against a dictionary and couldn't be a word in the dictionary. I thought this was all a bit much at the time, but as I said, I understand the need for security.
And yet AOL still reccommends to its home users that they store their passwords in a less than secure format on their local PCs.
Sure! You don't want anyone to intercept that large money transfer to Nigeria, do you?
I for one, welcome this. The more security they think they have, the more likely they are to trust you.
-- Prince Michael Okoya
In light of the recent additions to AOL Security....Phishers have had to update thier methods...its been reported that they IM using the following line...
"Hi, Im an AOL Service Represenative. Due to a high security threat, AOL has randomly changed your password to "Att25hj4" If you would NOT like to have your password changed please disable the second password feature by calling our toll free number(1-800-GOT-RIPP) and reply back with your existing password. Thank you and have a nice day!"
In an ideal world, the server and the fob are perfectly synchronized, meaning that the server knows which number the fob will generate at any given time. In the real world, the fob creeps behind/before schedule and generate a number x entries before/after the expected entry.
If this is the case, the server looks up if number x is in the vicinity (e.g.: within 5 minutes) of the expected number. If that's the case, the server assumes that the clock has drifted and marks the amount of time that the fob has drifted for next authentications.
If x is outside that range, but inside a much broader range (e.g.: one hour), it will request the number that the fob generates next, and checks if that number matches the one that should come after x. Then it marks the drift amount and allows access.
The server automatically compensates for inaccurate clocks in the fobs; as long as you use it regularly. Only if you have,'t used your fob for quite some time, and it has a really lousy clock they de-synchronize, requiring a hardware swap (and/or manual intervention from the sysadmin).
Okay... I'll do the stupid things first, then you shy people follow.
[Zappa]
Beat me to it...
What I would like to know is why the IT department at my place of work charges 80 GBP ($145) for these? Someone is on a winner down there, that's for sure.
This post contains benzene, nitrosamines, formaldehyde and hydrogen cyanide.
I'm rather concerned of the trend in today's journalism where the news aggregate is quoted as reporting something when it's really the Associated Press that is reporting something.
Get your citations straight! Don't be like the radio!
Kriston
The company that I was working for had little devices similar to that (They called them Token Cards) that would display a new code each time you pressed the button. It was a financial institution and they used it to protect their dial-up lines from people. They entered the code like this password*hashfromdevice.
Oh man, Lucas finally releases the original trilogy on DVD, AOL starts at least trying to have some form of security both in the same day. That has got to be a major sign of the impending apocalypse. If Microsoft announces it's dropping Windows to develop Linux before the day's out I'm heading for the mountains!
to handle all online transactions. I'd hate to carry one for my bank, one for my credit card, etc.
because they can't be making much money from this:
RSA sells these devices for $60 each or so in bulk. RSA fobs are programed to expire in 36 months. Let's say AOL got them for $50. The customers are paying 9.95+(1.95*36) or $80.15 over three years. That gives AOL $30.15 or about $10 a year. I'm sure aol could find some other way to fleece their users less than a dollar a month, leading me to believe this isn't just some profit making venture (not to mention the cost of the servers to implement this, which is not insignifigant.)
Go away, or I will replace you with a very small shell script.
There exist handshakes for proving I know something without revealing what it is.
Is any of it simple enough to perform -- perhaps with some idiot savant-y BIG_NUM manipulation tricks -- in your head?
It might take a bunch of passes, perhaps as many as one for each bit of entropy in your "secret", but I am sure there must be SOME way to set up my webmail so that I can authenticate myself into a "read the subject lines / senders of all NEW messages" session, with password1, or, with password2, into a "read the body of the NEWEST unread email" session. Thus I could "log in" even through a COMPLETELY COMPROMISED computer, keylogger and all, and unless I slip up on my mental math, without any device of any sort I could check my mail without compromising my inbox or identity. (no spamming-in-my-name; no reading-my-archived-email; no sniffing-my-authentication). There's not even anything a man-in-the-middle can do with my plaintext request for the newest unread subjects or bodies. There's no insertion attack.
background.
I love those little digital PIN devices... I thought they cost a lot more than that. Are those feasable for do it yourselfers to use at home for their SSH authentication? Once I was thinking about writing a script that changes the user ID of my remote login account every X minutes, and sends an SMS to my cell phone with the ID each time it changes, like my own cheap ripoff...
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
If you're lucky enough to have a decent screen name on AOL, like your first or last name, then you probably want to get one of these devices.
When I got my Yahoo account years and years ago I was early enough to get decent screen name. The problem is that today that account is routinely hacked (and once, even pwned, but thanks to the nice security folks at Yahoo, given back to me). People don't like to use something like "%geeba%56672" for Yahoo Instant Messenger. I imagine the same thing is true on AOL. Having a smartID or securiCard or other defense would be nice.
(Then again, auctioning off a nice AOL screen name might be worth a few bucks on eBay...)
After pestering employees with these damn things, AOL thought it would be wise to charge customers for the same pain in the ass.
I hate these stupid things. Keep them on your keychain, and you know it's going to break, and your going to have login problems. Don't keep it on your keychain, and you know you'll forget, and be unable to login. No matter what, you loose.
I won't say they are ineffective, since they do work. But they are the biggest pain in the butt.
Couldn't stand having it. What a drag.
Oh, and guess how many people loved using AOL mail in the workplace: None. Can you imagine this sinaero:
You sign on, do your work, leave for the day. Come back in, and AOL for some reason signed you off (happens every so often). Uh Oh... forgot the SecurID... no email for the day!
Was my post informative? Help me get a free flat screen by completing 1 silly little offer. I need one to go with my free iPod.
The advantage of the automagically generated password is that the password is a temporal function of the account. This means that the server and the password generator both work off the same clock base to calculate a password for your account and authentication succeeds if the two match (within some non-zero time window - to compensate for clock drift). the password is thus valid for a very short duration and makes it very hard for a MIM to capture, replay and use
As far as I can see the first (user memorised password) is merely an artefact of an older system left in there to make the user feel good about having some password control since that is the fator that is most vulnerable to compromise (think social engineering).
A more robust mechanism would be to add a challenge response to this mechanism - the suthenticating system gives you two numbers (n1, n2)which you feed into your password generator and it generates the response thus -
R sub t = f(t, n1, n2)
The authenticating system performs the same computation and accepts your password if it matches with the result generated locally. Banks in Sweden have been using this for quite a while now - the password generator is, of course, protected by a PIN number to unlock it for use and therin lies the weakest link!
See that long UID - that's what you get for lurking too long
Yeah, and if you have the RSA dongle and a remote car lock/starter, you can look forward to your keys taking on the characteristics of a porcupine.
I believe their charging because the device costs money and also they have to administer the RSA ACE/Server which I'm sure costs a lot in licensing and to keep it running.
Regards,
Steve
Whoop-de-do, we've been using SafeWord cards just about forever around here. Nice to see at least one ISP dragging itself into the '90s.
One thing I always wondered about these devices, is how you keep the device synchronized with the server. Since the code changes every 60 seconds, the server and the fob have to be set to within 1 minute of each other in order to agree on the same code.
A typical quartz clock has accuracy on the order of +/-10 ppm (parts per million). To accumulate an error of 60 seconds requires only 60 / (10 / 1M) = 6M seconds = 70 days. Therefore, it would seem after a few months, the fob would 'drift' enough to make the codes not match.
Does the user have to manually keep the time set? (Though, looking at the device on RSA's site, I don't see any buttons.) Does the server automatically accept a range of codes to allow for more 'drift'? Both approaches in combination?
That could be a hurdle to get over.
-
ping -f 255.255.255.255 # if only
Two-factor is indeed based on something you have and something you know. But "something you know" isn't your username; that's "something you are". "Something you know" is, in fact, your password.
Two-factor authentication actually has three factors. The username part is so insecure, however, that no one really counts it, because everyone has to know it in order to do any business with you at all. Many graphical login managers even present a list of usernames, because keeping these secret hampers the system's usability -no one knows who anyone is- for no real security gain.
The user-memorized password is not "an artifact of an older system"; it is still an important part of security, It is no longer the only important part of the security process, but it retains its importance.
1) it only lasts 60 seconds
2) if used , it can't be used again until the minute is up
Yup that will work for 1% of AOL users. The rest are screwed if it ever becomes mandatory. Sixty seconds is not enough time for about 99% of all AOL users. They'll spend the first 30 seconds trying to get the first password in and then type in the second password in the next thirty seconds -- only to figure out they got the two mixed up. Then they will spend all day typing in the same two passwords until they phone AOL at around 3:30pm.
The dangers of knowledge trigger emotional distress in human beings.
SecureID just seems like the next logical step. I used one for 3 years, and, once you get used to not attempting to log into your VPN when only the last bar is showing (there's a countdown bar indicating how much time is left before the number changes) it's really not so bad.
They appear to run on pseudo random number generators, and are synched up with the server with a known seed. I imagine they'd be very difficult to crack, as our system was configured to only allow 1 login attempt per number, if you typed in the wrong password/SecureID number, you had to wait until the next number came along. Annoying, but definitely better than the 3 (or 5) attempts and get a system admin to unlock your account.
The cesspool just got a check and balance.
Al Qaeda has ninjas!
If it doesn't show the same #, does AOL generate a new # every 60 seconds for every subscriber? Not sure, but that seems like a lot of work... Anyone know specs on the RSA algorithm used? From TFA: So they're talking about 25k key updates per second if they only have 5%. Is this a "you need a cluster of HAL-9001s to keep up" kind of problem, or is it more of a "that 486 you use as a doorstop could be useful again"?
This system is really a one time pad generated as a pseudo random sequence by the card and by the authentication server based on a common seed and starting time. The card will eventually drift out of sequence with the server and you will be required to enter some extra authentication steps to get back in sync. If you mess up with too many bad authentications, you get locked out and have to have the authentication server manually reset for your account.
Since if you know the algorithm (it's propietary with supposedly tamper resistant chips) and enough of the generated passwords, you could compromise that account, assuming you can guess the PIN before being locked out, it's a good idea not to lose or misplace the card, and to not use too trival a PIN or write it down.
What I'm curious to see is how this would affect "people who conduct large transactions online", who the article said were one of the target groups for this device. There are currently no plans to integrate this with banks or credit card companies, so how exactly does this protect peoples' account information? If bobbyjoe44@aol.com has an account at Bank One, I can still send them a fake "update your information" email, they put in their Bank One password and other info, and I get into their account. Meanwhile, the keygen thing is only protecting their AOL account and I'm cleaning out their bank account.
The only thing this really secures is AOL's bottom line, by preying off of peoples' fears and giving them something that makes them FEEL more secure online.
"It's aimed at small business and people who conduct large transactions online."
These people use AOL? I sure wouldn't do business with any company whose e-mail address was companyname@aol.com or whose web page was http://hometown.aol.com/coolguy12345
This is why /. is a great site for hobbyists and newbies. All you had to say for those with actual work experience is "AOL adds RSA keyfob support". I can almost make a necklace out my expired ones.
Intelligent Life on Earth
They need to include anti spyware / trojan software such as spybot search and destory ... why dont they plop a big donation to spybot and include it ?? Or fine come up with their own .. they only have what a few billion dollars of cash they're sitting on. This would be FAR more beneficial to their users security that this foo foo token thing. How many people REALLY need this? I admit it's of some benefit .. but sreiously overall including anti spyware software is vastly more beneficial.
quite a few do. I heartily recommend that they get their own domain name and they stammer, stare at me blankly, and then log on to AOL.
*tsccchh* "You've. Got. Mail." *tsccchhh*
Please stop stalking me, bro.
Back in the day on the school yard, we used to beatup all the AOLers.
"My daddy just got me AOL, look everyone!"
Yeah, we'd pelt him with a few dozen free AOL CDs.
You could always spot the AOLers, with that vacent look in thier eyes, the look of the newly assimilated.
Now a days AOLers are getting more advanced, they are able to creep up on you. You don't know till its to late. "Come, see my computer". "No, wait! - Why, what have I ever done to you?!"
Now they have these fobs. I can see it now. Someday I'll return to the old school yard, and one of my friends will spot the fob. I'll profess how its not for AOL, its for work. They won't believe me. I'll be pelted with CDs. Branded a traitor. They'll find out that I've had an AIM address for years. I'll be denied entry to the clubs. Women will find me attractive.
It used to be that only real nerds carried fobs. Damn you AOL.
I actually used these SecureID FOBS with 2 different systems, one of which was me Administering the Secure ID FOBS for a couple of months. There seemed to be alot of problems with the system. The system requires a 4 digit unique PIN for each FOB which is entered as well as the 6 digits in the window. The system is not supposed to give out duplicate PIN's....but every once and a while it would spit out one that was already in use, causing problems for the other person who had the same PIN. This would require me to reset their pin and tell them how to obtain a new PIN (easy...but still a pain in the ass as it shouldn't require this) FOBS would frequently go out of sync with the server, causing people calling me bitching...ah...it's a good system on a small scale...but when you have thousands of people using it, it can become a pain in the ass
Ermmmm,
Each number last for 60 seconds, so if it is just about to change you wait and type in the next number (there is a visual counter on the left of the device)
The back end ACE server knows the previous and next numbers, so adjusts for any internal clock changes which can be present on the card. If you meet an RSA sales person at a trade show, they may well offer you a demo card, these are generally production cards which ended up with clock speeds outside the QA range so look good but are effectivly worthless.
You can steal a card, but unless you know the user name and the secret password / username they are still worthless. To log in you generally need a user name / 4 digit pin and the number on the screen, lose one and the finder generally has simply an interesting desk ornament.
1) Long dial in times result in the 2nd password changing before completion, thus requiring a 2nd attempt (or a 9th, depending on how pathetic the phone service is)
Assuming you have some wacky setup that asks for the password before connection and not after you have already connected... then all SecureID based systems have a server running the same math as your little ID is and the server can, and does, calculate the previous and the next numbers the device will display. So even if the password takes 20 seconds to get there and it has changed in the meantime, it'll still authenticate, because the server is aware of the previous and next passwords.
2) Annoying easily lost dongle on your keychain that says "RSA- STEAL ME" in big bold letters...
I've been using these things for years and have yet to lose one. Of course, I never lose my keys either. If I lose my keys, I'd be more concerned about how to start my car than my account's security.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
My company already uses these for off-site employees so we can access the company intranet. Ditto for Mrs. Overt Coward's company, which is in a dramatically different field.
Or does Microsoft already have a patent on this?
So AOL's extending the system that they use for all internal AOL logins to the general public. Big deal. They never implemented the internal system correctly to start with, which reduced the effectiveness by quite a bit.
When you're using a SecurID, you're supposed to enter in the number displayed by the device and a PIN number. So if the device displays 12345 and your pin is 6789, you would enter 123456789 at the prompt to authenticate. The point of this is that it combines something you have and something you know. Now, of course AOL will say that they already have you entering something you know, in the form of your normal password.
But the other benefit of the SecurID setup is that if you increment (or decrement. I can never remember, since AOL never did it correctly) the PIN number by one when you enter it in, the authentication server will set off an alarm that says you're logging in under duress. Especially considering how much sensitive internal AOL employees have access to when they log in (of course, it varies based on what you need to have access to).
How many of you want to bet that AOL users start writing their password on a small slip of paper and taping it to the back of the SecurID?
-Todd
"The details of my life are quite inconsequential..."
"Two-factor authentication [...] is common in Scandinavia, Brazil, Singapore and selected countries."
That would be "Elita selected", wouldn't it?
Hint: Elita selected is a brand of coffee here, in Romania.
... not for AOL, but for VPN access when I work off site.
It works great. I'm actually more strongly authenticated that way then when I'm really at work (if you ignore social factors like "who the hell is that?"). I still need my network password to get to shares and email and so forth. And (not that this applies to the AOL situation) the VPN only grants me access to a specified list of servers, not everything theoretically in reach in the {US State Government}'s network.
BTW, those comments like "what business would use AOL"? You might want to grow up a little. Until relatively recently, it made good sense to have dial up accounts for your employees that they could use anywhere in the country, dealing with a large established company for billing and support.
AOL has local dial-up access pretty much everywhere. Useful for small business and anyone on the road.
This isn't a whole lot of use if you have a DSL connection using a router then, is it? This sounds like it would be impossible to use on a DSL solution.
Steps to create more security is always welcomed. Especially when it comes to log ins. It also creates a "perception" that AOL is secure, family oriented and trustworthy. I've been in the industry for several years -- these securID fobs have been around for a long long time and have been proven to be very effective. Haven't others on here had exposure to these? I can't believe that those who actually have used the system would complain. Then again, seeing all these complaints it leads me to believe "slashdotters" are less technical savvy than one would initially think. valder.
Great, so now we can be pretty sure that the person who logged into your AOL account is you. And for AOL services, they have a better trust of your identity. Well and good.
But the average user has more places they log into than just AOL. They log into the bank website. The phone company to pay the bill. The credit card company. etc...
I see 2 options here before this is more than a "so, what?".
1.) You get a seperate RSA keyfob for every site you log into. Which is obviously silly.
2.) Your AOL account becomes a "master account," where the credit card company, the bank, etc., all assume "well, if AOL thinks this is Bob, it must be Bob!" And that's Microsoft work!!! But regardless of who it is, it would imply placing your absolute trust in AOL (or someone else) as guardian of your identity, for EVERYWHERE you go online. Also implies that everyone agrees that AOL is authoritative. Merits of this have been debated to death, my opinion is "good idea in theory, but I trust AOL to have bug-free, unbreakable code about as much as I'd trust Microsoft....
Online mail services, banks, etc. should really all offer the option of using one-time passwords from strike lists.
The idea is simple: when you log in, you can either use your regular password, or you can use a one-time password from a printed list of passwords (you strike it out so you don't accidentally reuse it). You would use the one-time password when you log in in a public environment, when people might be looking over your shoulder, video taping the keyboard, have a key-logger installed, etc.
One-time passwords like that don't require any kind of special hardware, just a web page that lets you print a new list whenever you want to.
Almost all web-based services should offer this, in particular, web-based mail services like Yahoo!, AOL, etc.
...small small device from RSA Security...
Now, is that a really tiny device, or is there some acronym (SMALL?) of which I am unfamiliar.
Proverbs 21:19
Any decent ISP has local access pretty much anywhere. AOL hasn't really had an advantage in that regard for four or five years. The only excuse for using AOL is "not knowing any better".
If a job's not worth doing, it's not worth doing right.
Wow that would be awesome. What would be even sweeter is to add a simple biometric to that, not for Identification, but just as confirmation. Put in card (it knows who I am), enter physical time dependent password (I'm now authenticated), make my transaction, "would you like another", "Is everything correct? Thumbscan" (card pops out and you go about your merry way).
... mitigating damage caused by a theif not willing to add his thumbprint.
This way a biometric could be used only in the case of theft of both authenticators (not AS an authenticator). If you don't press your thumb on the pad, the ATM eats the card
Of course you better hurry and patent this, because someone else is about to. Despite it's obviousness to me.
Read Heinlein's 1953 Revolt in 2100, now more than ever.
I thought for sure that I read somewhere that they did.
Having worked as both an internet tech rep *and* as as a security admin handling these kinds of tokens, I can say that this is going to be a tech-support disaster for AOL.
First off, the more economical (read: cheaper) secureID tokens are notorious for being suseptable to static discharge, moisture and physical impact (dropping). They usually are made with a loop or hole in one end to attach to your id-badge at work: this will most likely be used to attach the device to Joe-Blow's keychain instead (also not good).
Second, a token *will* fall out of sync with the server if not used frequently (takes a few months). The result is a token that may be useful, but will require additional support (call AOL and wait) to resync before it may be used again.
Third, its a physical device that needs to be put in the hands of the user. It will take time to issue and replace, that the end-user may not have. Administrators at AOL *might* be willing to institute temporary passwords to side-step this, but once again, this requires another call to AOL.
Overall, the potential for repeated failure of these devices, in the hands of an ill-informed userbase (does anyone read directions anymore?), plus latencies all over the support process will result in an extremely hard to to manage product.
Furthermore, I seriously doubt that this will do more for AOL other than bolster its image as a secure service provider, which is possibly more than what its competition is doing; the actual product itself may only need to have a marginal value if any. Its a bold move, especially since the $2/mo plus $10 signup probably won't completely cover the hardware and support costs incurred.
ANYONE who uses AOL for their ISP and is running a business needs to run and not look back. It's nice that they are adding this but I think it's stupid (for AOL).
Now on the other hand for my work, I would love to implement this for our logins. It would definitely secure things much better.
Gorkman
Try (9.95 + 1.95) * 36 = $428.40
And if the little battery on the device goes?
:x
Candy-Coated Knowledge
Why doesn't some 3rd party company offer one of these devices to secure ALL of your online logins?
One device could then get you in to:
- bofa.com
- aol.com
- etrade.com
- etc etc
Why couldn't this be an optional security measure for purchasing through yahoo shopping, amazon, buy.com, etc?
I would gladly pay $10/mo for such a service. But it would have to be ONE device. I don't need 50 "pager-sized" devices.
Oh yeah, how about an RPM that lets you add this thing to your *nix login as well on any boxes where you have root?
You think it would be hard to get the first big client, like bofa.com? Probably, but once you get one the sell is much easier to the others.
Bravo to AOL for making this technology available to the general public.
slashsearch.org - slashdot search. powered by google.
The AOL service will be using RSA SecurID dongles, duh!
My employer has tens of thousands of employees (guess who) using the system and it has caused us no large problems. It removes moronic passwords and reduces the amount of stuff that people have to remember to their PIN number, which most people probably take from their ATM PIN anyways.
Outside of some of them breaking off of keychains, I have yet to see large problems with the system. Its one of the best authentication systems out there IMO.
And we could have a secureID card for each credit card! And one to start the car! And one to open the house door!
How about somebody comes up with a standardized smart card that can handle all of the above... And it might include a thumbscanner...
In addition, RSA SecurID hardware authenticators are manufactured and sealed with an integral lifetime battery. No user maintenance or battery replacement is required. As a result, this authentication solution is as easy to deploy and administer as it is to use.
Source: RSA Security - Hardware Authenticators.
What a ignorant, short-sighted (and possibly mean-spirited) thing to say.
Obviously you don't have a n00b who comes to you for computer help. It's just a fact that AOL should not be complicating their users this way. It is going to end up in techsupport Hell, and that was my point.
It's not mean spirited to speak the truth. Sometimes the truth hurts and that's why it's the truth.
The dangers of knowledge trigger emotional distress in human beings.
The company I work for has been using SecureID cards for years, the battery lasts around 5-6 years. AOL would probably want to send users a new card every 4-5 years.
"the devil finds work for idle circuits"
I used to use a 2 part password with an RSA Secure ID to login to a Cray Y-MP back in 1990. Quite a novelty this.
an ill wind that blows no good
They do go occasionally, and sometimes the cards get fucked - they're not super delicate, but enough abuse and they'll stop working.
The RSA admin tool allows an administrator (or someone with elevated privileges) to set a card into "lost mode", which allows setting a static password, and an expiry date for the lost mode - after which it disables the static password.
So, sending a card out via mail, should reach the user by the time their static password is going to expire, and they're back in business using the card.
I've worked with these things for somewhere around 7 years, and I pity the support people for AOL, and pity those that will need to use these cards. When they work, they work great, but it seems a fairly common thing for the cards to get out of sync with the server, in which case someone needs to resyncronize the card. It's a common enough problem in a smallish (~5000 users) support base (used for VPN, so you could knock that down to a percentage of that 5000) that I can easily see the support costs for AOL going wayyy up. And that's just a minor problem with the system.... there's also the case of a server crapping out (which can be semi-solved with redundant servers - which adds it's own problems to the mix)
I consider myself a power user and I have AOL set-up on my notebook.
I travel a lot around the US and Canada, and 99% of the time there is a local number I can dial to connect to the Internet. I couldn't care less for AOL "services" but it's great to check your corporate e-mail, connect through SSL-VPN, and even do some quick FTP uploads.
I haven't found another provider in the US that offers the same. My colleague claims that he was even able to use his account in Germany!
At home I have a high-speed cable connection.
Wearing pants should always be optional.
My ex-girlfriends's dad works as a vp for the magazine division of aol time warner, he has one of these little keychain rca jobs, but hes been using it to log into his aol account before i started dating her.
e&y?
At first, my reaction to this article was along the lines of, "Holy crap...AOL users get two-factor authentication, and I can't get my bank to come up with anything better than a password and an SSN as the login ID!" But then, while I was repeatedly slamming my head in the file cabinet drawer to distract myself from such frustration, I thought about it. And when you really come down to it, I think that AOL accounts are heavily targeted, and that this is, on the whole, a case of strong authentication that makes overwhelming sense.
Think about it...how many times have you heard of people wanting to "hack aol so i cn read my girlfriends mail i think she is cheating on me can u help pls?" I've seen it over and over again. And then you have to consider things that are more likely (like shoulder-surfing) with AOL accounts. Using SecureID makes all of that FAR harder.
And what about the other less-obvious benefits? Little Timmy got in trouble in school today? Sure you could go into parental controls and block his use, but I think it'd be more poignant (and easier for the non-techie parent) to just have him surrender his token. I'm sure that there'll be other manifestations like this that I haven't even considered, also.
So on the whole, not only is this a good idea for security, I don't think it's even close to overkill to be doing it with AOL users. The benefits are that significant.
For your security, this post has been encrypted with ROT-13, twice.
We used these for a client project a couple of years ago. They worked really well and I'm actually surprised more companies don't use this.
Anyone know if there is an open source equivelent?
A friend of mine was working as a call center rep for them and ran into a similar problem. She was fired for having too long an average call time, though she wasn't over by very much and no one warned her that she was taking too long. Keep in mind, this was just 3-4 weeks after she finished four weeks of (paid) training. Great ROI there guys.
She found out later that a couple days after she was fired, a CS VP came down to give her an award for getting perfect scores in all her customer feedback.
ATMS are actually pretty secure. On just about every ATM and about to be required by all the major banks and card issuers the pin pad hashes your pin in hardware and even the ATM itself never sees your plaintext pin.
Microsoft is giving away Windows XP SP2, its free security overall to the OS to both licensed and unlicensed users. Now AOL is charging their customers wanting to keep their accounts from being used by spammers and other criminals. Why should anyone have to pay to prevent unauthorized usage of their account? AOL has reached a new low with this one.
Large transactions online?
I'm pretty sure people who do large online transactions don't use AOL...
Large transaction to me is something over $500,000.00
Jokes about AOL users aside, this isn't a good thing.
RSA key password systems are designed to lock the account after X number of failed tries. After that, the fob and the account have to be resynced to one another.
Anyone interested in causing AOL and the AOL\fob users will just need to keep bonking the login screen enough times and the account will be "inconvenienced".
Another problem is that of lost fobs. Another physical item to lose which could deny access to the users account.
Sounds more like a "make aol rich scheme" rather than an honest "protect the users" scheme. If this IS an attempt to protect users, then it means the normal AOL system is insecure enough that people who don't want to get screwed will have to pay just to maintain a decent level of security...
At least, that's what it looks like.
Winged Power Photography
Two pages into the last link of the original post you find:
, 00.asp
http://www.pcworld.com/howto/article/0,aid,116989
This article gives a two-factor security example in which a bank mails a user a sheet with perhaps 50 scratch-off numbers unique to that user on it. The user would need to enter a password and one of the scratch-off numbers to log into his account. Once a scratch-off number was used, it would "die" never to become valid again. A new set of 50 numbers would be mailed out each month with the bank statement.
The banks where I do business don't use this, but it seems like a really good idea. IANASE (I am not a security expert) but isn't this a one-time pad approach? Has anyone seen this used? It may be more common than I realize.
Could the idea be expanded to other fields? Is there a better way than snail mail to deliver the scratch-off sheets?
Sorry about being anal, but the keys are generated every "sixty" seconds *NOT* six seconds. Six seconds is about how long it takes for me to put in my PIN and the 6 digit number.
in a palm or something, using an access PIN to decrypt the local secret.
That only saves you money of course if everyone already has a PDA.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
The fobs are only about $20. I used to work at AOL, and if we lost ours, that was the charge to the department for replacement. $20. That's the rate they buy them at for 9000-10000 employees. They do a deal with RSA to open up SecurID to the world, the price will go down significantly.
I'd be willing to bet that $9.95 is break-even cost on the fob, and the $1.95 gets split evenly between RSA and AOL.
So far, analysts predict this to only appeal to a narrow range of AOLers, guesstimating 5 to 15% of the member population. On the low side, let's take 5% of 30MM users, = 1.5MM people. At a measley $0.975 each (revenue split with RSA), * 1.5MM users, that's $1.4MM per month, that's about $17MM/year of revenue for AOL and $17MM/year for RSA.
I'd like to be the guy who found $17MM of revenue for my company.
Plus, as it's already there to support employees, the infrastructure is already built in to the AOL login servers, so there is no net new cost there.
Last I knew, only OpsSec had access to bind/unbind fobs, sometimes you also needed to resync them. But, it would be trivial to train the member services team on resetting the fobs, resetting, etc.
From a security perspective, now instead of simply calling up and pretending to be you to get your password reset, I call up pretending to be you, and have lost "my" fob and get the account unbound until I find it... but maybe they'll have some precautions around that.
Get a phone with Java. Make sure your home machine is using NTP (or GPS, or both) to keep accurate time. Your phone should get it's time from the cell tower (or GPS if it has that).
Write a J2ME app (or find one, I think you can) that takes the current time rounded to the nearest minute, asks you for an unlocking-PIN, which is used to decrypt a shared secret. Hash the secret with the current time (SHA-1 is good enough). Show the lower 8-bytes or something.
On the server, write a PAM module that does the same thing, except maybe it creates 8-byte hashes for a minute behind and ahead and behind too, and accepts any of them (to account for time jitter).
So you go to log in, pop open your java app on your cell, type in the PIN, write down the hash, and then use that to login via SSH or FTP or whatever.
Of course, ssh public-key authentication is just as secure as this (you have key halves on each side, the client side's protected by a pass-phrase, you encrypt a random challenge which is dependant on time, among other things...) Actually, I think I trust a PKI-scheme with 1024+ bits more than a symmetric hash-based system.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
This isn't some method to fleece customers. It's a way to establish credibility. I've had SecurID fobs for years. They are a pain in the ass, but they are secure. They are reliable. I've never had any problem with "out-of-synch" as one other thread mentioned.
It was nice for travelling. I could get into our intranet from anywhere in the world.
-- No sig for you!
I've used these doo-hickies. The thing has an expiration date (about a year) and you have to swap out periodically. The battery lasts long enough to get you past the exp. date. Never had one croak before it had to be swapped anyway.
The machine may not see your PIN but somebody looking over your shoulder could
Atleast with a PIN and a SecureID you have less of a chance of somebody seeing your PIN and stealing your SecureID tag.
---
"WebTV: bringing the Internet into the shallow end of the gene pool since 1995" - Martin Bishop
Caveat: if junior is anything like me, he'll either do some social engineering and get another token issued, or find another way to get dialup. Of course, if junior's mom is anything like mine was, that won't be under the radar for that long. My biggest motivator from 7-15 was trying to outwit my parents.
Exaaaactly. If a small business relies on AOL for their ISP/road-warrier needs then chances are they really aren't aware of security issues. One good spin on this is it is exactly these sort of people that will buy into to this ... bad spin being that they will indeed bleed information (credit card#, account logins for banking) via some other orifice.
-----
Web Hosting @ HostForADollar.com
...a roomate worked for digital city in the late nineties and had an AOL account as a result. In addition to his password he had a small keychain that generated a six digit number that had to be entered as well.
I just got off the phone with AOL (well, their India-based customer support, actually) and they say that AOL has no such device.
In fact, they got a supervisor on their radio who was barking questions like "how did you know about it?/Who told you?/Are you an AOL employee?/We don't have any such item." (etc.).
Sounds like AOL India is into a FUD campaign of their own. Maybe, being tens of thousands of miles away, they are actually the last to know about this device?
If anyone hears how to get one, please email me. I'd love to try it.
Thanks!
This is false. While ATMs are required to have this functionality, it's not required to be enabled until 2006. Almost no one has turned it on, even though the functionality is there. The security of ATM machines is poor, I should know, I worked with them for about a year doing network stuff on the backend, which required in depth knowledge of how the machine worked and how to admin it.
A little more security could be added by forcing a user type his PIN *and* his SecurID/SafeWord/CryptoCard code, but that doesn't stop a motivated attacker with knowledge of how the machines communicate with the banks auth server. In several scenarios, the PIN is irrelevant, in fact, having a valid card is irrelevant also.
I do security for a living, and I've been doing it for a long time. Obviously, I don't know everything, but some of the scenarios I mentioned I brought up with Deibold, and they agreed that they do pose a threat.
Anyone who thinks an ATM is secure is just plain wrong.
Need Free Juniper/NetScreen Support? JuniperForum
I guess I don't see how this will make a system more secure in an office setting. Let's take my dad who works for a local government agency, as an example. To log on to his work station, he needs to enter in his password. Because he has to change his password every 60 days to something new, he writes it in Sharpie on his CPU unit for everyone to see and crosses out the old one. (If he didn't have to enter in a new password every two months, he'd still probably write it on his computer just to make sure he wouldn't forget it.) Now let's say he needs to enter a password from a key fob. I'd say he's not very likely to take the device with him because he would be afraid of losing it or forgetting it. So he'd probably leave it right on the CPU with his Sharpie-written password. Heck, he'd probably write the password right on the back of the fob. Unfortunately, anyone coming into his office could still gain unauthorized access to his computer. Doesn't sound very secure to me.
As someone that has had to work with SecurID more then once, I can tell you its a heaping pile from the 80s. The client librarys are crap, mostly written for winblows, and ported by some grad students via macros. Two factor authentication is usally charecterized by 'something you have and something you know' You know your password (pin in rsa parlance) and you have a token which has a value, toghter you get a passcode. Really AOL should have been smarter and just issued digitial certificates to their users. This would make the hardware not required (unless you used usb dongles to hold the cert) but also allows for much higher encryption, better managment, and its cheaper as all you need to do is create your own CA, and start issuing certs. Im rather surpised that verisign didnt try to win the aol deal.
Lets just say it sucks. I worked over at an outsource Earthlink call center for a while in Las Vegas and that was about as dumb a mistakes as I could ever make. I had the exact opposite problem of being too fast with calls. No I wasn't a tosser I just got to stuff quickly and just got it done since 90% of the problems were just needed a dialup #, a rebuild of the TCP/IP stack and a new dialup connection, was something I couldn't help em with ("I'm cheap and don't wanna pay someone to fix my computer so I called you since I pay Earthlink $20 a month" people), or it was something we were supposed to send to level 2 (of which half of them were women and had were "easy" to say the least so there wouldn't be much help there). Ended up getting hassled too constantly because my average time would be anywhere between 5-7 minutes and then when there was a call I actually needed to take some time with they'd tell me to get them off the phone the moment I hit 10 minutes. Finally ended up not showing up for a month after they decided to make everyone on the floor learn to "support" Macs and reduce my pay back to everyone else's since I was one of like 6 that knew how to even work a Mac (I was level 2 Mac, but not PC...go figure) and came in, grabbed my check and my supervisor was so dense she asked me if I was working that day. Just handed her my badge and walked out. Hope she got the message finally.
Then don't give users the option to save thier passwords.
If I recall, AOL started requiring the use of SecurID keyfobs for content-provider logins sometime around 1996, when they rolled out their graphical form-design tools or Rainman Plus or something.
Given how many corporate workers, especially in field sales, use AOL as their travel ISP since it's so easy to change cities and countries, it's about time AOL recognized the demand for this kind of thing.
In most ways, AOL's a goofy (and expensive) choice for a business ISP, but very few dialup ISPs bother to offer a decent dialer addon with a built-in worldwide database of access numbers, so AOL remains one of a handful of low-fuss chocies for the kind of person who ends up in a different city (or country) every few days and just wants to plow through their email.
Atleast with a PIN and a SecureID you have less of a chance of somebody seeing your PIN and stealing your SecureID tag.
I'm a bit confused.. ATM's already use two-factor authentication: What you know (your PIN) and what you have (your ATM card). Doesn't using a SecurID just add another "what you have" factor? Or are you just saying that you're less likely to lose both your SecurID and card at the same time?
I see a lot of merchants using yahoo for their transactions. Maybe this is aol trying to get into the same.
Also I know Ford uses this technology for remote logins.
naa, the advantage of using AOL is the perceived customer support. I thought MCI tought us years ago that large ISPs couldn't provide anywhere near the support of small ISPs. But some don't learn.
Hey, I was actually being serious.
(And I actually liked a lot of AOL's features, seems to have bundled plenty of pay/'plus' services available on the Internet for their customers... oh well.)
Get your Unix fortune now!
So, AOL has gone and bought some RSA Radius
Servers for their customers (finally).
Maybe its time to buy some RSA stock again.
Uhh, I've had my Yahoo account since 1996 and have never had an issue with crackers or hackers. Not once....ever.
Perhaps you should think about changing your password? I may be talking out of my ass here but to my knowledge, Yahoo is fairly difficult to crack. Yes, you can guess passwords, phish, etc....but I've yet to hear of a Yahoo account getting owned without SOME help from the legit owner of the account.
Anyone else care to chime in? I only speak from my own experience.
During logon, the user enters their user ID and the sequence number from their card. Since the sequence number changes every 10 seconds, the user has ten seconds to enter the current sequence number when they log in. If they don't make it in ten seconds, the login is not allowed, and they have to enter the next sequence number. There is a small "bar graph" next to the sequence number that tells the user exactly how much time they have left to enter the number.
Our system used the model of SecureID with the built in keypad. The system we used was different from the AOL system in that you entered a PIN into the card, and the card would then tell you what the correct sequence number you should enter was. The SecureID AOL chose to use always displays the sequence number, and you enter it and your password when you log on. The SecureID system we used is more secure, because someone can't use a keylogger to get your password, and then steal your card.
The sequence number is then authenticated against a server (called ACE) that is able to calculate the next sequence number for any card that it knows about. When logging in, the card's version of the sequence number is compared to the ACE server's version of the sequence number, and if it matches, the login is allowed. The ACE logon sequence can be integrated into any application using a fairly simple API. For our application, we integrated the ACE API with NSAPI for use with Netscape servers.
Now, here's the problem. The algorithm is not without its faults. Sometimes the card and the server disagree on what the next sequence value is. This can happen easily if you don't enter the sequence number within the 10 second time limit a number of times, or the sequence number changes just as you finish entering it. When this happens, the card is considered "skewed", and there is a sequence of operations that need to be performed to "unskew" the card, that consist of having the user enter the currently displayed sequence number a number of times. If there is a problem unskewing the card, the user gets locked out. A user can also be locked out if their card is skewed too many times.
Skewing happens often enough to be annoying from a technical support point of view. We had to deal with it quite often with our application, and we did not have more than 200 users. Our users were used to dealing with security, and this type of hardware was not new to them (i.e. experts). Now think about how many cluless users AOL is going to have for this service, and how many people are going to mess up when unskewing their card. This is going to be a technical support nightmare.
Show me on the doll where his noodly appendage touched you.
They did not turn it on? That is perhaps the worst possible idea ever (on the ATM operators end of things) but you do seem to know more than I about it. So I can just tap the line between those supermarket atms and the bank and get everyones info? I did recently become aware that the maintenence access on some of those atms comes up from pressing two of the buttons at once and the password is just a short pin number.
I've been using SecurID for two years now, and it's never gotten 'out of sync', nor have I heard of such a thing happening to anyone in the company (10k+).