Schneier On Un-Authentication

Trailrunner7 writes "Bruce Schenier writes on Threatpost.com: 'In computer security, a lot of effort is spent on the authentication problem. Whether it is passwords, secure tokens, secret questions, image mnemonics, or something else, engineers are continually coming up with more complicated — and hopefully more secure — ways for you to prove you are who you say you are over the Internet. This is important stuff, as anyone with an online bank account or remote corporate network knows. But a lot less thought and work have gone into the other end of the problem: how do you tell the system on the other end of the line that you are no longer there? How do you un-authenticate yourself? My home computer requires me to log out or turn my computer off when I want to un-authenticate. This works for me because I know enough to do it, but lots of people just leave their computer on and running when they walk away. As a result, many office computers are left logged in when people go to lunch, or when they go home for the night. This, obviously, is a security vulnerability.'"

Comments

Effective way to keep screens locked

[stefanb]

A bank I did some consulting work for had a very effective cultural rule to force people to lock their machines when they left their desks: if you find an unlocked machine, pull up the email client and send a message to everyone: "today's my birthday, drinks on me after work!" (other NSFW messages left to the readers imagination.)

Apparently, very few people left their machines unlocked more than once...

Re:Effective way to keep screens locked

[MyLongNickName]

So, you are a thief?

Re:Effective way to keep screens locked

[aardwolf64]

Of course, the fun rose exponentially when two people had their machines unlocked. I would frequently carry on a whole phantom conversation.

"Hey, let's go to lunch tomorrow"
"I can't, I have to wax my hamster"
"I didn't know you had a hamster"
"..."

Re:Effective way to keep screens locked

[MyLongNickName]

No, moron, you are basically having a charge appear on someone else's account for services you got.

And the services are not purely electronic. You got a service that really cost someone else money.

And on top of that, you assume I download music/other files illegally. I don't.

So, not only are you a thief, but you are not very bright. And you jump to conclusions that are not supported by the facts.

Re:Effective way to keep screens locked

[Velorium]

Well see here, you actually created a charge for somebody else to pay. The first thing of know-how to piracy is that stealing is removing an item (what you did). Piracy is making a copy of an item (downloading). If you're trying to justify actually stealing something, do so in a way that's at least somewhat logical.

Re:Effective way to keep screens locked

[cbiltcliffe]

How is using physical paper and toner paid for by someone else with their money the same as downloading a digital version of a movie that you already have the VHS for, but it got chewed up when your VCR died?

There's a very good reason why the laws of virtually every country in the world DO NOT consider downloading data to be theft.

Because it's not.

It's copyright infringement.

I'm not saying it's right, or justified, or anything to do with the moral right or wrong of it. If you come out with a comment about how I'm a scofflaw just because I don't think it's stealing, you've just shown your own immaturity, and complete lack of awareness of the situation, as well as sheer arrogance in putting words in my mouth.

The simple legal fact is, the two are not connected in any way, regardless of entertainment industry propaganda.

Re:Effective way to keep screens locked

[HAKdragon]

The real fun is to create a new folder before doing the screenshot and then deleting it right after.

Re:Effective way to keep screens locked

[MyLongNickName]

Hi Commodore,

You again make assumptions about my behavior. I can quite honestly tell you I have not done any of the above except ad blocking, which is neither illegal nor amoral.

You again fail to see the very obvious. You charged your services to someone else's account. This isn't complicated.

As far as my "sinning", yes I have done things I wish I hadn't. However, you come here bragging about what you have done, and then continue to justify your actions using absolutely moronic logic. if you want to follow your "sin" analogy, then you have not "repented". While you are unrepentant, you are to be treated as though you an outside, shunned and ignored.

The bottom line is that you stole from the people you did this to.

Re:Effective way to keep screens locked

[AmiMoJo]

You can get little RFID tokens that you keep in your pocket. When you move out of range of the RFID reader on the PC (about 3m away) it automatically locks the workstation and can either require a password to unlock or simply having the token back in range.

Re:Effective way to keep screens locked

[Anonymous Coward]

I was 17 and stupid

Well, at least you aren't 17 anymore. 1 out of 2 isn't bad.

Re:I lock my computer when I walk away

[Deag]

I'll save you a keystroke, windows-L works too.

Solutions that work, but are too bulky.

[Animats]

Back before ease of use eclipsed security, I once encountered a military system where the access terminal was surrounded by a small fence. Opening the gate in the fence forced an immediate logout.

Nobody would tolerate that today. Except, maybe, for an ATM.

Re:Solutions that work, but are too bulky.

[fuzzyfuzzyfungus]

Trouble is, anywhere except a building full of guys with guns, you would also have encountered an ingenious arrangement of paper clips and/or packing tape holding the door sensor permanently in the closed position...

Reauthenticate when suspicious

[Geoffrey.landis]

Requiring re-authentication whenever a logged-in user does something suspicious-- i.e., tranferring large amounts of money, installing a keylogger, sending out ten thousand e-mail messages, scanning networks for open ports, etc.-- might be useful.

If you really do need to do this kind of thing (I suppose people sometimes do have legitimate requirements to wire large amounts of money to offshore accounts), it's not a big hassle to log in again.

MS solved this problem, but removed it with W2K+

[Tumbleweed]

Windows 95/98/ME had a built-in solution to this problem, but MS removed it in the Win 2K and newer. They simply had the machine crash every 2 hours. Heavy handed, sure, but it worked.

Re:How do you un-authenticate?

[spydabyte]

You're the first person to address the real issue he's talking about and not the simple example of leaving a computer unlocked.

Think of a remote connection to Remote Desktop for Windows. When does the server know when to sever the connection? Is it after some time delay of minimal activity? If it's left authenticated for time X, and the ability for the traffic to be hijacked is Y, are X and Y proportional?

It's not as simple as I walk away from a physical machine anymore. My favorite is when an application doesn't close when you press the X in windows (upper right) or OS X (upper left). It's connections are still left open, leaving authentication on opening the application worthless.

It still works in XP

[davidwr]

At least it does on my compu[BSOD graphic goes here]

Re:It still works in XP

[CannonballHead]

that's cool, your BSOD also pushes preview/submit automatically. :)

Re:I lock my computer when I walk away

[Ephemeriis]

Then make the lock at 11 minutes or u can give your mouse a click while u re talking.Doesnt sound that hard.U just have to adopt.

But... I don't want any more children.

This is De-Authorizing, not De-Authenticating

[zentechno]

One other system used more prevalently is the simple locking screen saver. The idea is only the user, and sysadmin have the password to unlock the screen, and access through the system is prohibited until the screen saver password is entered. I'm not a fan of this, as generally screen-saver passwords are more-often assigned by the users themselves, and so are easier to guess than the back-end passwords which on occasion are set by the site, or by the sysadmin in the case of accessing corporate systems via corporate-policy. Now a minor, but important distinction. This isn't "un-authentication" this is de-authorizing the computer from which you're logged in accessing the place you're logged in to. You want to "authenticate a de-authorization" that is verify that you are the person removing access privileges. If the system doesn't require authentication to de-authorize access, then a denial of service attack is made (somewhat) trivial, and if more thought process went into understanding the difference I think more places would realize how serious the solution needs to be.

In the Marine Corps...

[RingDev]

Any time someone left a machine unlocked in the MC we would pounce on it. It would take less than 2 minutes to get emails out to the appropriate members of the chain of command to volunteer the Marine for every shit duty we could find (and swap his or her desktop background screen saver to something highly entertaining or inappropriate).

-Rick