Slashdot Mirror
Schneier On Un-Authentication
Trailrunner7 writes "Bruce Schenier writes on Threatpost.com: 'In computer security, a lot of effort is spent on the authentication problem. Whether it is passwords, secure tokens, secret questions, image mnemonics, or something else, engineers are continually coming up with more complicated — and hopefully more secure — ways for you to prove you are who you say you are over the Internet. This is important stuff, as anyone with an online bank account or remote corporate network knows. But a lot less thought and work have gone into the other end of the problem: how do you tell the system on the other end of the line that you are no longer there? How do you un-authenticate yourself? My home computer requires me to log out or turn my computer off when I want to un-authenticate. This works for me because I know enough to do it, but lots of people just leave their computer on and running when they walk away. As a result, many office computers are left logged in when people go to lunch, or when they go home for the night. This, obviously, is a security vulnerability.'"
A bank I did some consulting work for had a very effective cultural rule to force people to lock their machines when they left their desks: if you find an unlocked machine, pull up the email client and send a message to everyone: "today's my birthday, drinks on me after work!" (other NSFW messages left to the readers imagination.)
Apparently, very few people left their machines unlocked more than once...
ctl + alt + del -> k on windows, and ctrl + alt + l on ubuntu. that's all. a lot of offices also have windows security policies set to lock the screen after 5 minutes idle.
Designing systems for usability is hard, especially when security is involved.
Meh.. I was hoping for some deeper insights than that.
I've lost all my marbles except one & It's fun to test angular & centripetal acceleration in my skull
Back before ease of use eclipsed security, I once encountered a military system where the access terminal was surrounded by a small fence. Opening the gate in the fence forced an immediate logout.
Nobody would tolerate that today. Except, maybe, for an ATM.
If you really do need to do this kind of thing (I suppose people sometimes do have legitimate requirements to wire large amounts of money to offshore accounts), it's not a big hassle to log in again.
http://www.geoffreylandis.com
Windows 95/98/ME had a built-in solution to this problem, but MS removed it in the Win 2K and newer. They simply had the machine crash every 2 hours. Heavy handed, sure, but it worked.
While yes, there are technical measures that you can put in place to automatically lock screens and accounts and such after a pre determined time period, the best solution is a policy, and actual enforcement of that policy. There in lies the problems in many organizations, enforcement is not being done consistently.
With technical controls, there is always that time frame, for example idle accounts, usually 30 days from last login and then automatically lock the account, well a malicious user has 30 days to which to attempt access to that account. Same goes for screen locks, 15 min is a common default, well you walk away and I have 15 min to make my way over and have fun with the account. You can reduce the amount of time, but that has other issues, users get annoyed at the screen locking while they are on the phone, or whatever while they are at their desk, results in crappy passwords.
With a policy, and enforcement behind it, accounts can be removed, users will lock their screens (hopefully) within a timely manner.
I came, I conquered, I coredumped
You're the first person to address the real issue he's talking about and not the simple example of leaving a computer unlocked.
Think of a remote connection to Remote Desktop for Windows. When does the server know when to sever the connection? Is it after some time delay of minimal activity? If it's left authenticated for time X, and the ability for the traffic to be hijacked is Y, are X and Y proportional?
It's not as simple as I walk away from a physical machine anymore. My favorite is when an application doesn't close when you press the X in windows (upper right) or OS X (upper left). It's connections are still left open, leaving authentication on opening the application worthless.
In my office an unlocked computer is fair game for harmless pranks that have become known simply as pwning.
Nothing too nasty happens as the shame is in having been pwnd, not in the severity of damage inflicted.
There, my computer just announced "it's one thirty" in a robot voice. Nice. Thanks a lot, guys.
At least it does on my compu[BSOD graphic goes here]
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
You make the client system re-authenticate after a configurable amount of time, and that authentication comes via central storage of authentication passwords/tokens. For example, Keychain.
My laptop is set up with SSHKeychain, and it has options for locking my Keychain. If I activate the screensaver and don't come back within 3 minutes or so, it locks the keychain, and any program that wants to use a stored password triggers a password authenticaton dialog box for the system keychain password.
This puts the power of security in the hands of the user or organization. Computer at home, no roommates? Probably not an issue to lock your keychain any time except when you shut down your computer. Work in a cube? After 5-10 minutes of inactivity or whenever you lock your screensaver.
Please help metamoderate.
Hardcopy Playboy. It gets around the web monitoring software.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
On a Mac, that closes the window, but the application is still running.
Circumcision is child abuse.
Some places use smartcards, the card must be in the slot or it locks your screen... The same card is also used to open the doors so if you leave the room without taking the card then you can't get back in. Most people had the card attached to their belt or similar.
Another idea is to track the location of your phone using bluetooth (10 meters range), if you walk too far away it loses signal and locks the screen.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
If you are running KDE, and want proximity detection, you can set it up to listen for your phone's bluetooth radio and lock/unlock in response to the absence/presence of that signal.
Kbluelock.
One other system used more prevalently is the simple locking screen saver. The idea is only the user, and sysadmin have the password to unlock the screen, and access through the system is prohibited until the screen saver password is entered. I'm not a fan of this, as generally screen-saver passwords are more-often assigned by the users themselves, and so are easier to guess than the back-end passwords which on occasion are set by the site, or by the sysadmin in the case of accessing corporate systems via corporate-policy. Now a minor, but important distinction. This isn't "un-authentication" this is de-authorizing the computer from which you're logged in accessing the place you're logged in to. You want to "authenticate a de-authorization" that is verify that you are the person removing access privileges. If the system doesn't require authentication to de-authorize access, then a denial of service attack is made (somewhat) trivial, and if more thought process went into understanding the difference I think more places would realize how serious the solution needs to be.
âoeThe wall between art and engineering exists only in our minds.â -- Theo Jansen
Do a "Print Screen" of their desktop and set it as their wallpaper. Then set their taskbar to auto-hide and set the desktop to hide icons. Enjoy watching them click all over the reactionless bmp trying to open stuff.
Today's Sesame Street was brought to you by the number e.
Then the screaming started. Folks would walk away from their computers and come back to a locked screen... But they wouldn't know how to log in. They didn't know what username and password to put in there because it looked ever so slightly different from what they saw when they first showed up in the morning.
You have to have the cooperation of the people at the top of the organization, who would send a memo to everyone saying that for security reaons, this is what you WILL do, and failure will result in discplinary action. If you're a hospital or something you would be insane not to. It worked where I work.
Or someone would walk away for an hour or two without logging off, and someone else would have to use their computer while they were gone.
You need more computers then. Everyone here has one on their desk, I thoght that was pretty much the norm at any company.
Or someone would want to quickly glance at some information, but the computer would be locked and they'd either have to unlock it themselves or find someone else to unlock it.
It only takes a few seconds to log back in. And once it's explained to them how to do it, they shouldn't have to ask again.
If I were in your position I'd be looking for a job somewhere that's likely to still be in business in five yeras, because it sounds to me like you sre surrounded by idiots from the CEO on down. I'd hate to have a job like that, and if they're as stupid as you make them out to be, I don't know how they're going to stay solvent.
Of course, in a lot of instances you don't really need security; if it's a small shop with a dozen people working there, everyone with a key to the building whose doors stay locked the physical security should suffice. I have my home PC set up so I don't have to enter a PW at all unless I need to do something as root.
Free Martian Whores!
I disagree. Google is a search engine and doesn't always know which is the best answer (or even the right one).
A Merrian-Webster dictionary or OED is considered a primary source for standard word definition (or existence). In the academic and engineering world we care about where the 'facts' come from. So sources do matter.
If you know where to look in a trusted and accurate source, you should always go there before a search engine. Yesterday, I needed to know the syntax for srncpy. So I typed man strncpy, I didn't goto google.
Any time someone left a machine unlocked in the MC we would pounce on it. It would take less than 2 minutes to get emails out to the appropriate members of the chain of command to volunteer the Marine for every shit duty we could find (and swap his or her desktop background screen saver to something highly entertaining or inappropriate).
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
I have no idea how to do it in bash, but you can easily lock a computer from the command line in Windows.
rundll32.exe user32.dll,LockWorkStation
Another one:
rundll32.exe shell32.dll,SHExitWindowsEx [0|1|2|4|8]
0: logoff, 1: shut down, 2: reboot, 4: forced shutdown, 8: powers down the machine
This would be a fun one to put in the Startup menu of someone who left their PC unlocked, actually... :D
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
OCSP/CRL, certificate revocation list. If you have found a fraudulent site or a legit site who's cert has been compromised contact the signer and have them add it to their CRL/OCSP blacklist. I'm not sure if there is any mechanism for a local CRL, though you can certainly stop trusting a signer if they show a significant lack of diligence in screening their clients.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.