3 ms·

Is this a stand-alone fob-style system, where the keycode is unique to a point in time with no knowledge of the connection? Or is this some sort of second-chann

by roc 16y ago

Is this a stand-alone fob-style system, where the keycode is unique to a point in time with no knowledge of the connection? Or is this some sort of second-channel verification, where the requesting connection is hashed into the one-time-pad?

groby_b 16y ago
Both Paypal and WoW use standalone FOB, keycode unique to a point in time. Of course, paypal's "I lost my authenticator, log me in anyways" button is kind of defeating the purpose...
- roc 16y ago
  Ok, but what is Google offering? Unless I'm missing something, RFC 4226 sounds like the RSA SecurID system I've worked with before; which is essentially equivalent to Blizzard's system for World of Warcraft. In which case, my criticism stands. It's trivially more difficult to phish a keycode and the limited window of opportunity is simply a non-issue.[1] Unless Google is calculating a one-time pad based on the individual login attempt and sending it along a second channel to the registered user, there'll be almost no reduction in phishing. [1] The tens of seconds a keycode is valid are more than enough to establish a connection.
  - groby_b 16y ago
    Which means you phished it once. Which means you need to take drastic actions to exploit it, a slow buildup over time is not an option. Which in turn means you're more likely to get detected. It's not full protection - you'd still need a second channel for that - but it's better than nothing.
    - roc 16y ago
      It is certainly better than nothing. I just took issue with the article's repeated insistence that it'd make phishing harder/impossible. It does many good things. That is not one of them.
  - lutorm 16y ago
    For the systems I log in to, each SecurID code is only valid once. If you want to log in again, you need to wait until a new code is available and use it.
  - teejae 16y ago
    See: http://en.wikipedia.org/wiki/HOTP http://en.wikipedia.org/wiki/HOTP and http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm http://en.wikipedia.org/wiki/Time-based_One-time_Password_Al... You can download the Google Authenticator app. These algorithms are known. You can implement it yourself if you wanted to.
gregable 16y ago
Stand-alone where the keycode is unique to a point in time with no knowledge of the connection.

by roc 16y ago

groby_b 16y ago

Both Paypal and WoW use standalone FOB, keycode unique to a point in time. Of course, paypal's "I lost my authenticator, log me in anyways" button is kind of defeating the purpose...

roc 16y ago
Ok, but what is Google offering? Unless I'm missing something, RFC 4226 sounds like the RSA SecurID system I've worked with before; which is essentially equivalent to Blizzard's system for World of Warcraft. In which case, my criticism stands. It's trivially more difficult to phish a keycode and the limited window of opportunity is simply a non-issue.[1] Unless Google is calculating a one-time pad based on the individual login attempt and sending it along a second channel to the registered user, there'll be almost no reduction in phishing. [1] The tens of seconds a keycode is valid are more than enough to establish a connection.
- groby_b 16y ago
  Which means you phished it once. Which means you need to take drastic actions to exploit it, a slow buildup over time is not an option. Which in turn means you're more likely to get detected. It's not full protection - you'd still need a second channel for that - but it's better than nothing.
  - roc 16y ago
    It is certainly better than nothing. I just took issue with the article's repeated insistence that it'd make phishing harder/impossible. It does many good things. That is not one of them.
- lutorm 16y ago
  For the systems I log in to, each SecurID code is only valid once. If you want to log in again, you need to wait until a new code is available and use it.
- teejae 16y ago
  See: http://en.wikipedia.org/wiki/HOTP http://en.wikipedia.org/wiki/HOTP and http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm http://en.wikipedia.org/wiki/Time-based_One-time_Password_Al... You can download the Google Authenticator app. These algorithms are known. You can implement it yourself if you wanted to.

gregable 16y ago

Stand-alone where the keycode is unique to a point in time with no knowledge of the connection.