Slashdot Mirror
Secure Ways to Determine 'Something You Have'?
Steve Cerruti asks: "My credit union is implementing multi-factor authentication for online banking. They are following guidelines provided by the Federal Financial Institutions Examination Council as outlined in Authentication in an Internet Banking Environment (PDF). As you are already required to enter a password, 'something you know' is covered. 'Something you are' has significant technical hurdles while 'something you have' is familiar to credit unions in the form of ATM cards.
My credit union chose to implement 'something you have' as a two dimensional lookup table that they email to an address you supply when you initially log in to the online banking service, further access is blocked until you enter a code from the table. New Measures to Make Online Access Safer describes the plan and a short video (FLV) provides further details." For the security conscious among us, do you think this is a decent way to implement the 'something you have' portion of a well secured system, or are there better ways to do it?
Their plan can best be compared to single use scratch off cards. However, I am unsure of what constitutes "something you have" in this example. If someone has the capacity to log into your online banking account, it would seem an email account would be equally subject to access. It would therefore be possible for the authorized owner and the attacker to both possess the table simultaneously. Does this system provide multi-factor authentication or is it simply a convoluted mechanism for sharing yet another secret?
Off topic questions:
Is depending on near instantaneous access to email a reasonable thing to do?
If you were dealing with this situation, would you implement a Firefox extension or a cell phone application to reduce the level of effort for banking access?"
Their plan can best be compared to single use scratch off cards. However, I am unsure of what constitutes "something you have" in this example. If someone has the capacity to log into your online banking account, it would seem an email account would be equally subject to access. It would therefore be possible for the authorized owner and the attacker to both possess the table simultaneously. Does this system provide multi-factor authentication or is it simply a convoluted mechanism for sharing yet another secret?
Off topic questions:
Is depending on near instantaneous access to email a reasonable thing to do?
If you were dealing with this situation, would you implement a Firefox extension or a cell phone application to reduce the level of effort for banking access?"
My banks idea of security is entering a word in an image like you see on so many sites these days.
Those images are distorted so a computer can't just OCR the thing and brute force passwords (my understanding anyhow). This seems to have worked out well enough that you see it everywhere and brute forcing passwords is less of an issue (if at all).
Curiously my bank decided to implement this functionality differently. The background is a grey colored word, and it's always the same word. The "code" is always black.
I'm no genius but to the best of my knowledge this isn't much beyond an exercise in vigorous masturbation. Security through song and dance if you will?
Platform advocacy is like choosing a favorite severely developmentally disabled child.
I watch the video and it sounds like a lot of PR talk and buzzwords to me.
At the end of the day, assuming the computers and networks between you and the credit union are secure (they're not, but let's forget that), the only problem they have is to make sure you're Mr. John Doe, legitimate holder of the account you're trying to access ("who you are"). Period. All that matrix and multi-identification stuff is just a variation on the same theme.
Up to now, "what you know" (a password) was assumed to be representative of "who you are", with the single point of failure that someone else might be able to know what you know as well (being your password that's too simple, or someone looking over your shoulder while you type in the password). This was a reasonable assumption because you can't separate someone with this someone's knowledge.
If they want to do better than that, they'll have to use biometrics (DNA analysis, fingerprinting, iris scanning, etc...) or some sort of permanent electronic tagging (RFID implant). That's plain as day. So if your credit union isn't providing you a fingerprint scanner or telling you to go to your local vet to get a RFID implanted, you can safely assume that their new ultra-super-duper solutions are a variation of what's already been implemented before, perhaps a little better, perhaps not, but definitely a lot of PR fluff.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
A Danish bank mails you a card with 50 4-digit numbers. This is your one-time pad of sorts. When you log in to your account it asks you for, say, #23. You provide it, and it never asks for it again. When you're down to 20 numbers left or so, the bank automatically mails you another card. The card is something you have.
BPH (Polish bank) has your cell phone number on file. They do bank transfers, which are used over there a lot more than here, you can pay people directly like that (like an electronic check), even buy skype credit directly with it. When you attempt a transfer the bank sends you an SMS with a code you have to supply to the website. The cell phone is something you have. Trouble with this is that in the US some people have to pay for incoming SMSes. In the rest of the world that's usually free.
boldly going forward, 'cause we can't find reverse
Hello -
I tend to like "zero-knowledge proof" based systems.
Here, you don't exchange an item (e.g. password) directly.
For example, a server can challenge you (your smart card by proxy) with a randomized value / set of values.
Your card performs a function, and returns a value.
If the value doesn't match the accepted value, the challenge has failed. Only your card should return the correct value. However, someone else's might by chance succeed, or there may be an attack.
So, this type of set of exchanges can be repeated until a (probabalisticly satisfactory threshold is reached). If all the answers are acceptable, you have passed.
I forget the names of the people who were key in such mechanisms years ago.
The name quisqatuer (forgive my spelling) was one of them. I think he was French.
A nice part of such schemes is that (properly implemented), they are highly resistant to a number of forms of attack including sniffers and man-in-the-middle attacks.
> "But if the client's only point of interaction with the bank is through a single computer, that computer must be trusted. I don't see how you could have a secure system if that only point of interaction is compromised."
Simple: don't trust that computer. Home computers are general-purpose machines and very few of them are highly secured. A specialized, embedded device with a private key sounds much more trustworthy, and you could still use the untrusted home computer to transmit the resulting encrypted+signed message over the Internet.
Evidently, the key to understanding recursion is to begin by understanding recursion. The rest is easy.
Shouldn't take more than n/2 on average ... and for the two digits, just pick any 2 digits at random, and you have a 1/100 chance of being right the first time. If they give you 3 chances each call, you need, on average, to make 18 calls to get access, no matter how long the actual password is.
How it is done in Norway:
1. You get a keypad in the post, a small (3x2)" thingy with numbers 0-9 and a tiny calculator-style screen.
2. You also get instructions how to set a four-digit PIN code on it for first use.
3. To log in to the internet bank, you enter your personal number (SSN equivalent), and type the PIN into the pad. It gives you an eight digit code.
4. You enter the first six digits of the code. The bank displays the last two, which should match your card's.
Hackable? Phishable? Any flaws? I can't see any, except for a trojan piggybacking on top of your connection, but that's a bit far fetched.
It's what client-side certificates were for in the first place, but the idea seems to been forgotten.
I'd hate to the be the first organization trying to exercise the client-side certificate code...
You'd have to completely and permanently disable non-certificate logins or phishers would would still be in business.
What I really think is that the length of this window of opportunity does not matter at all. There are reports that universal phishing kits exist already, making it really simple for anyone not only to create a phishing site but also to mount a man-in-the-middle attack. This makes coordinating with your money laundering agent the most difficult and time-consuming part of the entire attack.
Furthermore I think that those solutions are superior that give the user better control over transactions carried out on his or her behalf. SecureID fails to achieve that. It just makes authentication slightly stronger where identity never was the primary issue.
http://erichsieht.wordpress.com/category/english/
My CU recently added "more security" to my account. I need to jump through a couple of hoops to have them write some kind of cookie to my PC. In order to improve the hoops, they asked me some "password challenge" questions.
When I went to log into my account from a second PC, their system asked me the challenge questions. For elementary school attended, did I answer "jones" or "jones elementary" or "jones elementary school" or "Jones" (you get the idea)
At any rate, since my answers the second time failed to exactly match, my account was locked and I had to call the customer service number to get my account unlocked. They reset my challenge questions, and told me that lots of people are having this problem. As a result the CSRs tell people to answer those questions with a single word, and to USE THE SAME WORD FOR EVERY ANSWER!
This system is broken.
Whatever you do, don't build a broken system.
But Herr Heisenberg, how does the electron know when I'm looking?