Slashdot Mirror
Secure Ways to Determine 'Something You Have'?
Steve Cerruti asks: "My credit union is implementing multi-factor authentication for online banking. They are following guidelines provided by the Federal Financial Institutions Examination Council as outlined in Authentication in an Internet Banking Environment (PDF). As you are already required to enter a password, 'something you know' is covered. 'Something you are' has significant technical hurdles while 'something you have' is familiar to credit unions in the form of ATM cards.
My credit union chose to implement 'something you have' as a two dimensional lookup table that they email to an address you supply when you initially log in to the online banking service, further access is blocked until you enter a code from the table. New Measures to Make Online Access Safer describes the plan and a short video (FLV) provides further details." For the security conscious among us, do you think this is a decent way to implement the 'something you have' portion of a well secured system, or are there better ways to do it?
Their plan can best be compared to single use scratch off cards. However, I am unsure of what constitutes "something you have" in this example. If someone has the capacity to log into your online banking account, it would seem an email account would be equally subject to access. It would therefore be possible for the authorized owner and the attacker to both possess the table simultaneously. Does this system provide multi-factor authentication or is it simply a convoluted mechanism for sharing yet another secret?
Off topic questions:
Is depending on near instantaneous access to email a reasonable thing to do?
If you were dealing with this situation, would you implement a Firefox extension or a cell phone application to reduce the level of effort for banking access?"
Their plan can best be compared to single use scratch off cards. However, I am unsure of what constitutes "something you have" in this example. If someone has the capacity to log into your online banking account, it would seem an email account would be equally subject to access. It would therefore be possible for the authorized owner and the attacker to both possess the table simultaneously. Does this system provide multi-factor authentication or is it simply a convoluted mechanism for sharing yet another secret?
Off topic questions:
Is depending on near instantaneous access to email a reasonable thing to do?
If you were dealing with this situation, would you implement a Firefox extension or a cell phone application to reduce the level of effort for banking access?"
RSA SecurID is an excellent "what you have". It displays a number that changes every minute, so there's no need for a special interface. Your server has the seeds, so it can figure out what number's being displayed on a given SecurID at any given moment in time.
Global symbol "$deity" requires explicit package name at line 2. - If only $scripture started "use strict;"
My banks idea of security is entering a word in an image like you see on so many sites these days.
Those images are distorted so a computer can't just OCR the thing and brute force passwords (my understanding anyhow). This seems to have worked out well enough that you see it everywhere and brute forcing passwords is less of an issue (if at all).
Curiously my bank decided to implement this functionality differently. The background is a grey colored word, and it's always the same word. The "code" is always black.
I'm no genius but to the best of my knowledge this isn't much beyond an exercise in vigorous masturbation. Security through song and dance if you will?
Platform advocacy is like choosing a favorite severely developmentally disabled child.
I watch the video and it sounds like a lot of PR talk and buzzwords to me.
At the end of the day, assuming the computers and networks between you and the credit union are secure (they're not, but let's forget that), the only problem they have is to make sure you're Mr. John Doe, legitimate holder of the account you're trying to access ("who you are"). Period. All that matrix and multi-identification stuff is just a variation on the same theme.
Up to now, "what you know" (a password) was assumed to be representative of "who you are", with the single point of failure that someone else might be able to know what you know as well (being your password that's too simple, or someone looking over your shoulder while you type in the password). This was a reasonable assumption because you can't separate someone with this someone's knowledge.
If they want to do better than that, they'll have to use biometrics (DNA analysis, fingerprinting, iris scanning, etc...) or some sort of permanent electronic tagging (RFID implant). That's plain as day. So if your credit union isn't providing you a fingerprint scanner or telling you to go to your local vet to get a RFID implanted, you can safely assume that their new ultra-super-duper solutions are a variation of what's already been implemented before, perhaps a little better, perhaps not, but definitely a lot of PR fluff.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Require an X509 client side certificates. That should make access to the account practically impossible unless an attacker can get access to the certificate.
The only way to access the certificate would be to compromise the client machine, and if that happens your probably fucked regardless, right?
A Danish bank mails you a card with 50 4-digit numbers. This is your one-time pad of sorts. When you log in to your account it asks you for, say, #23. You provide it, and it never asks for it again. When you're down to 20 numbers left or so, the bank automatically mails you another card. The card is something you have.
BPH (Polish bank) has your cell phone number on file. They do bank transfers, which are used over there a lot more than here, you can pay people directly like that (like an electronic check), even buy skype credit directly with it. When you attempt a transfer the bank sends you an SMS with a code you have to supply to the website. The cell phone is something you have. Trouble with this is that in the US some people have to pay for incoming SMSes. In the rest of the world that's usually free.
boldly going forward, 'cause we can't find reverse
> "But if the client's only point of interaction with the bank is through a single computer, that computer must be trusted. I don't see how you could have a secure system if that only point of interaction is compromised."
Simple: don't trust that computer. Home computers are general-purpose machines and very few of them are highly secured. A specialized, embedded device with a private key sounds much more trustworthy, and you could still use the untrusted home computer to transmit the resulting encrypted+signed message over the Internet.
Evidently, the key to understanding recursion is to begin by understanding recursion. The rest is easy.
When I call my bank, they never ask me for say, my full telephone pin. They ask for 2 random digits.
So this gives you passwords within passwords. You can have a fifteen digit number/password, and they ask you for random characters from those. Always try to ask for a different combination, and perhaps ask in more ingenious ways, like the third letter and the fourth from last (which could be the same position as the third - if you had a stupid password).
You can then keep the password long enough for it to not be too much of a bother to remember. And they can always disable the account if too many wrong tries are made.
The cleverest thing to do though, is to probably make it harder to do international transfers of cash using accounts, or impossible online. And make it harder to have an account without giving some form of verifiable ID. My bank does that. It is quite silly to steal money online into another local account in my estimation anyway, because you will be caught. Internationally is another issue, because some countries may not cooperate.
Anyway, how many people do you know who have had their money stolen from their bank accoount online. I guess very few.
For those who missed it, the above post is enclosed in [sarcasm] tags
I could never figure out how anyone could believe that "name of favorite pet" or "last 4 digits of your phone number" or "name of your [insert whatever here]" is a good security question.
Now, to answer the REAL question posed by the article's title:
- the answer is obvious - go to an anonymous clinic in another part of town, use a fake name, and pay the doctor in unmarked bills :-)
One of my local Wells Fargo branches asked for my thumbprint in order to get my balance, after depositing my check. This was despite showing them my ID. They didn't want to see that. When I asked why, and refused to provide a print, I was told to go talk to the manager.
She explained it was a policy to speed up identification, etc.
The customer service agent didn't implement the policy, she doesn't know why she has to collect the thumb print any more than you do. You assumed the thumb print was to provide confirmation of your identity in order to *authorize* the transaction. This is not the case, and also why they don't really care that they've never collected a thumb print before. The purpose of the thumb print is to provide *evidence* after the fact in case there is a fraudulent transaction.
Suppose you are head of Wells Fargo's security department. The CEO has mandated that you implement "greater security" and the CFO demands that you do so on a minimal budget. Which of the following do you choose?
1) Implement a new program requiring millions of customers to come into a physical banking location and establish their authorized thumb print, regardless of their account age, banking history, account balance, or fraud risk. Maintain a secure, reliable, online database of all these thumb prints. Make the database accessible to several thousand banking locations. Implement a near-100% accurate thumb print recognition algorithm. Ensure that all the components in this system can operate at near-instantaneous speed so transactions can be authorized in a timely manner.
Cost to bank: several hundred million dollars
Cost to users: hassle for thumb print at each transaction
2) Implement a new program that requires thumb prints to be taken for each transaction. Thumb prints may be collected on paper, stored at the local banking location, archived only occasionally, and are only ever referenced if a transaction has been flagged as fraudulent. If such a thing does happen, surveillance tapes and the thumb print may be supplied to law enforcement for further action.
Cost to bank: in the tens of millions of dollars
Cost to users: hassle for thumb print at each transaction
Both methods produce essentially the same amount of security, particularly for dumb criminals who may not know that the bank is relying on method 2 and not method 1. I honestly can't say I would have chosen differently either.