Slashdot Mirror
Secure Ways to Determine 'Something You Have'?
Steve Cerruti asks: "My credit union is implementing multi-factor authentication for online banking. They are following guidelines provided by the Federal Financial Institutions Examination Council as outlined in Authentication in an Internet Banking Environment (PDF). As you are already required to enter a password, 'something you know' is covered. 'Something you are' has significant technical hurdles while 'something you have' is familiar to credit unions in the form of ATM cards.
My credit union chose to implement 'something you have' as a two dimensional lookup table that they email to an address you supply when you initially log in to the online banking service, further access is blocked until you enter a code from the table. New Measures to Make Online Access Safer describes the plan and a short video (FLV) provides further details." For the security conscious among us, do you think this is a decent way to implement the 'something you have' portion of a well secured system, or are there better ways to do it?
Their plan can best be compared to single use scratch off cards. However, I am unsure of what constitutes "something you have" in this example. If someone has the capacity to log into your online banking account, it would seem an email account would be equally subject to access. It would therefore be possible for the authorized owner and the attacker to both possess the table simultaneously. Does this system provide multi-factor authentication or is it simply a convoluted mechanism for sharing yet another secret?
Off topic questions:
Is depending on near instantaneous access to email a reasonable thing to do?
If you were dealing with this situation, would you implement a Firefox extension or a cell phone application to reduce the level of effort for banking access?"
Their plan can best be compared to single use scratch off cards. However, I am unsure of what constitutes "something you have" in this example. If someone has the capacity to log into your online banking account, it would seem an email account would be equally subject to access. It would therefore be possible for the authorized owner and the attacker to both possess the table simultaneously. Does this system provide multi-factor authentication or is it simply a convoluted mechanism for sharing yet another secret?
Off topic questions:
Is depending on near instantaneous access to email a reasonable thing to do?
If you were dealing with this situation, would you implement a Firefox extension or a cell phone application to reduce the level of effort for banking access?"
RSA SecurID is an excellent "what you have". It displays a number that changes every minute, so there's no need for a special interface. Your server has the seeds, so it can figure out what number's being displayed on a given SecurID at any given moment in time.
Global symbol "$deity" requires explicit package name at line 2. - If only $scripture started "use strict;"
My banks idea of security is entering a word in an image like you see on so many sites these days.
Those images are distorted so a computer can't just OCR the thing and brute force passwords (my understanding anyhow). This seems to have worked out well enough that you see it everywhere and brute forcing passwords is less of an issue (if at all).
Curiously my bank decided to implement this functionality differently. The background is a grey colored word, and it's always the same word. The "code" is always black.
I'm no genius but to the best of my knowledge this isn't much beyond an exercise in vigorous masturbation. Security through song and dance if you will?
Platform advocacy is like choosing a favorite severely developmentally disabled child.
I watch the video and it sounds like a lot of PR talk and buzzwords to me.
At the end of the day, assuming the computers and networks between you and the credit union are secure (they're not, but let's forget that), the only problem they have is to make sure you're Mr. John Doe, legitimate holder of the account you're trying to access ("who you are"). Period. All that matrix and multi-identification stuff is just a variation on the same theme.
Up to now, "what you know" (a password) was assumed to be representative of "who you are", with the single point of failure that someone else might be able to know what you know as well (being your password that's too simple, or someone looking over your shoulder while you type in the password). This was a reasonable assumption because you can't separate someone with this someone's knowledge.
If they want to do better than that, they'll have to use biometrics (DNA analysis, fingerprinting, iris scanning, etc...) or some sort of permanent electronic tagging (RFID implant). That's plain as day. So if your credit union isn't providing you a fingerprint scanner or telling you to go to your local vet to get a RFID implanted, you can safely assume that their new ultra-super-duper solutions are a variation of what's already been implemented before, perhaps a little better, perhaps not, but definitely a lot of PR fluff.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Require an X509 client side certificates. That should make access to the account practically impossible unless an attacker can get access to the certificate.
The only way to access the certificate would be to compromise the client machine, and if that happens your probably fucked regardless, right?
A Danish bank mails you a card with 50 4-digit numbers. This is your one-time pad of sorts. When you log in to your account it asks you for, say, #23. You provide it, and it never asks for it again. When you're down to 20 numbers left or so, the bank automatically mails you another card. The card is something you have.
BPH (Polish bank) has your cell phone number on file. They do bank transfers, which are used over there a lot more than here, you can pay people directly like that (like an electronic check), even buy skype credit directly with it. When you attempt a transfer the bank sends you an SMS with a code you have to supply to the website. The cell phone is something you have. Trouble with this is that in the US some people have to pay for incoming SMSes. In the rest of the world that's usually free.
boldly going forward, 'cause we can't find reverse
Hello -
I tend to like "zero-knowledge proof" based systems.
Here, you don't exchange an item (e.g. password) directly.
For example, a server can challenge you (your smart card by proxy) with a randomized value / set of values.
Your card performs a function, and returns a value.
If the value doesn't match the accepted value, the challenge has failed. Only your card should return the correct value. However, someone else's might by chance succeed, or there may be an attack.
So, this type of set of exchanges can be repeated until a (probabalisticly satisfactory threshold is reached). If all the answers are acceptable, you have passed.
I forget the names of the people who were key in such mechanisms years ago.
The name quisqatuer (forgive my spelling) was one of them. I think he was French.
A nice part of such schemes is that (properly implemented), they are highly resistant to a number of forms of attack including sniffers and man-in-the-middle attacks.
From the horse mouth:
h ting_fraudu.html
http://www.schneier.com/blog/archives/2006/11/fig
My CU implemented a system whereby I now have two passwords. I guess they are probably following the law, but I'm not safer from anything now, especially since they put some text by the second password telling me what it is about. One of the better comments from the Schneier post points out that two factor authentication isn't worth much if they both use the same channel. Another goes ahead and calls it multiple single factor.
One of the better solutions is to require a phone call(ooh, another channel) for 'high risk' transactions. There are problems with that, but at least it adds some security. Fobs and scratch cards are decent too, but they are susceptible to man in the middle attacks(or whatever you want to call them, they just make phisher more sophisticated).
Nerd rage is the funniest rage.
There's a big difference between having your box taken over and used to spam the world, and having your box taken over and your 5-figure bank-account drained.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
When I call my bank, they never ask me for say, my full telephone pin. They ask for 2 random digits.
So this gives you passwords within passwords. You can have a fifteen digit number/password, and they ask you for random characters from those. Always try to ask for a different combination, and perhaps ask in more ingenious ways, like the third letter and the fourth from last (which could be the same position as the third - if you had a stupid password).
You can then keep the password long enough for it to not be too much of a bother to remember. And they can always disable the account if too many wrong tries are made.
The cleverest thing to do though, is to probably make it harder to do international transfers of cash using accounts, or impossible online. And make it harder to have an account without giving some form of verifiable ID. My bank does that. It is quite silly to steal money online into another local account in my estimation anyway, because you will be caught. Internationally is another issue, because some countries may not cooperate.
Anyway, how many people do you know who have had their money stolen from their bank accoount online. I guess very few.
Maybe you should send me your userid, password and that table and I'll let you know if it's secure.
For sale: Signature. One owner. Low miles. Always garaged. New punctuation, just installed!
For those who missed it, the above post is enclosed in [sarcasm] tags
I could never figure out how anyone could believe that "name of favorite pet" or "last 4 digits of your phone number" or "name of your [insert whatever here]" is a good security question.
Now, to answer the REAL question posed by the article's title:
- the answer is obvious - go to an anonymous clinic in another part of town, use a fake name, and pay the doctor in unmarked bills :-)
It's what client-side certificates were for in the first place, but the idea seems to been forgotten.
I'd hate to the be the first organization trying to exercise the client-side certificate code...
You'd have to completely and permanently disable non-certificate logins or phishers would would still be in business.
One of my local Wells Fargo branches asked for my thumbprint in order to get my balance, after depositing my check. This was despite showing them my ID. They didn't want to see that. When I asked why, and refused to provide a print, I was told to go talk to the manager.
She explained it was a policy to speed up identification, etc.
The customer service agent didn't implement the policy, she doesn't know why she has to collect the thumb print any more than you do. You assumed the thumb print was to provide confirmation of your identity in order to *authorize* the transaction. This is not the case, and also why they don't really care that they've never collected a thumb print before. The purpose of the thumb print is to provide *evidence* after the fact in case there is a fraudulent transaction.
Suppose you are head of Wells Fargo's security department. The CEO has mandated that you implement "greater security" and the CFO demands that you do so on a minimal budget. Which of the following do you choose?
1) Implement a new program requiring millions of customers to come into a physical banking location and establish their authorized thumb print, regardless of their account age, banking history, account balance, or fraud risk. Maintain a secure, reliable, online database of all these thumb prints. Make the database accessible to several thousand banking locations. Implement a near-100% accurate thumb print recognition algorithm. Ensure that all the components in this system can operate at near-instantaneous speed so transactions can be authorized in a timely manner.
Cost to bank: several hundred million dollars
Cost to users: hassle for thumb print at each transaction
2) Implement a new program that requires thumb prints to be taken for each transaction. Thumb prints may be collected on paper, stored at the local banking location, archived only occasionally, and are only ever referenced if a transaction has been flagged as fraudulent. If such a thing does happen, surveillance tapes and the thumb print may be supplied to law enforcement for further action.
Cost to bank: in the tens of millions of dollars
Cost to users: hassle for thumb print at each transaction
Both methods produce essentially the same amount of security, particularly for dumb criminals who may not know that the bank is relying on method 2 and not method 1. I honestly can't say I would have chosen differently either.
My CU recently added "more security" to my account. I need to jump through a couple of hoops to have them write some kind of cookie to my PC. In order to improve the hoops, they asked me some "password challenge" questions.
When I went to log into my account from a second PC, their system asked me the challenge questions. For elementary school attended, did I answer "jones" or "jones elementary" or "jones elementary school" or "Jones" (you get the idea)
At any rate, since my answers the second time failed to exactly match, my account was locked and I had to call the customer service number to get my account unlocked. They reset my challenge questions, and told me that lots of people are having this problem. As a result the CSRs tell people to answer those questions with a single word, and to USE THE SAME WORD FOR EVERY ANSWER!
This system is broken.
Whatever you do, don't build a broken system.
But Herr Heisenberg, how does the electron know when I'm looking?