Comments on Ian!: Worse than Nothing

@matthewkrieger That's true, I suppose multifactor...

2010-02-17T13:46:22.597-06:00

@matthewkrieger That's true, I suppose multifactor would defeat the information-harvesting model where sensitive data is collected and then auctioned in bulk.

SMS authentication is an interesting idea, and it's nice to see a creative approach to the field. I don't know enough about cell phone security to give an opinion on how attack-resistant it is, and I haven't had any firsthand experience with such a system. It may well be the wave of the future, though. There are just too many problems with passwords alone, and the continuing absence of any commonplace public key infrastructure means institutions are going to need to bootstrap their own solutions.

@Ian - You make a great point about two-factor a...

2010-02-17T12:38:34.729-06:00

@Ian -

You make a great point about two-factor authentication not being a panacea for phishing exploits. Two-factor authentication schemes based on 1-time passwords should reduce some risk though because the exploit would have to be done at the same time (in-line) as the user's login, vs. later on.

The inconvenience of physical tokens is (generally) inversely proportional to the tech savvy of the user. Bank of America (and I assume some other banks) have a two-factor scheme based on 1-time passwords/pins sent via sms.

@matthewkrieger, Well, true multifactor authentic...

2010-02-16T15:51:41.036-06:00

@matthewkrieger,

Well, true multifactor authentication definitely has some security benefits. For example, a brute force password attack is out of the question (assuming, of course, that the second channel is not compromised).

But the frightening power of phishing attacks is that they largely bypass this type of security. Multifactor provides no protection against a standard man-in-the-middle. If a fake site tricks me into giving my password, it can trick me into punching in my one-time code too.

I agree that SiteKey is not two-factor, and in fact I think the confused application of that term muddles the fact that it actually addresses a different need. Mutual authentication is about proving that the site you're about to log in to is the site you think it is, and unfortunately I don't think multifactor can help with that problem.

So I'm not totally opposed to real multifactor solutions, but they're no panacea, and the keyfob thing is a serious inconvenience. I shudder to imagine five years from now - I'll no longer have a different username and password for every site, I'll have a different username, password, and keyfob. I'll have to keep a little janitor's keyring next to my desk for all my fobs.

Ian, In your opinion how much safer do you think ...

2010-02-16T12:53:56.007-06:00

Ian,

In your opinion how much safer do you think that some form of true two-factor authentication (I don't consider SiteKey to be two-factor - I'm referring to some physical keyfob with changing numbers or one-time passwords, possibly sent via SMS) would make things in an online banking scenario?

Regards

The RSA product security team would like to extend...

2009-09-28T19:42:09.803-05:00

The RSA product security team would like to extend its appreciation for hearing from you in advance of your post last week. We take all responsible communication like yours very seriously and quickly confirmed no technical issues existed within our RSA Adaptive Authentication platform, including its Site-to-User module. As you referenced, we provided all RSA Adaptive Authentication customers with information about Clickjacking, the UI Redress attack that involves multiple and oftentimes transparent frames which can make certain Internet browsers vulnerable. Mitigations can include utilizing a Frame Buster or increasing the security within browsers.

In addition to site-to-user, RSA Adaptive Authentication works behind-the-scenes with a risk engine that monitors device identification, geo-location, behavioral profiling, and feeds from a networked community sharing fraud data. An anomaly can trigger an alert to initiate an out-of-band phone call or challenge/response questions in order to verify an identity.

Organizations that conduct business online should assume that all of their users’ PCs are compromised in some manner and should prepare their security infrastructures accordingly. You are right, there is no silver bullet in security. We recommend a comprehensive and systematic approach to help reduce online threats. This includes implementing multi-layered security such as risk-based authentication, two-factor authentication, transaction monitoring, and the shutting down of online attacks. We also encourage all Internet users to stay educated and take both technical and behavioral security precautions. There are dozens of resources online that provide tips and tricks to greatly help in this effort.

my password is "ianyoungismyfavorite" for Commerce...

2009-09-26T11:52:46.736-05:00

my password is "ianyoungismyfavorite" for Commerce Bank in Normal, Illinois.

That's the equivalent of phishing in a phish pharm.