5 ms·

Public key authentication isn't an acceptable alternative? You could have users unlock a keyring using a password containing a single, global public key for ea

Public key authentication isn't an acceptable alternative? You could have users unlock a keyring using a password containing a single, global public key for each machine they own. You could have them do the same with a thumbdrive or mobile phone. You could authenticate using a number of methods. It's really incrediably flexible. I think the problem is not that there isn't something to replace it, it's that people are used to "username:password" and don't want to switch. Public key authentication has too many options while passwords are just single words.

qjz 15y ago
I agree that public key authentication is an improvement over passwords. Now show me a system that my mother-in-law can use (passphrases are out, she can't remember them).
- pyre 15y ago
  How about adding in another factor of authentication and make the passphrase a hash of data from a biometric scan (e.g. retina scan)?
  - marshray 15y ago
    Is it secret? If so, how do you change it if it gets disclosed? If not, how hard is it to make a fake eyeball? How do you know the user's actually being authenticated and it's not just a replay of a previously captured image? Do you require a trusted hardware scanner now? If so, how do you deploy it to all your users? How do you keep the attacker from taking it apart and reverse engineering it? But most of all, how do you know the user is actually intending to authenticate the thing that is being authenticated? E.g. the user is wants to open door A so they put their eyeball up to the scanner, but the bad guy has installed a skimmer (like on ATMs) which replays the users retina and lets him into door B. Biometrics usually raise more questions than answers IMHO.
    - pyre 15y ago
      Awesome. I'm so glad that you have shown me the light. I now realize that we are perfectly and 100% secure right this very moment and that the security system of using the same password everywhere (e.g. password = 'password') is working out so well for people! [Also: If a user enters <FORM OF AUTHENTICATION>, how do we know for sure that they aren't entering <FORM OF AUTHENTICATION> under duress? We'd better just scrap this whole authentication thing altogether.]
      - marshray 15y ago
        I now realize that we are perfectly and 100% secure right this very moment Lol. :-) If a user enters <FORM OF AUTHENTICATION>, how do we know for sure that they aren't entering <FORM OF AUTHENTICATION> under duress? Haven't you heard of the three factors of authentication? Something they steal, something they chop off, and something they beat out of you... We'd better just scrap this whole authentication thing altogether. You can't. It's a fundamental activity, as old as the the first cell membrane (this is me, this is not me). Multicellular organisms have immune systems (which are often fooled). Babies (sometimes switched at birth) recognize their mother's voices right when they're born. Ever visit another city and people there can just tell right away you're from out-of-town? The irony is that millions of years of evolution has given us humans so much built-in natural hardware for authentication that we're now doomed to underestimate the inherent complexity and subtlety of the problem.
        pyre 15y ago
        > Haven't you heard of the three factors of authentication? > > Something they steal, something they chop off, and something they > beat out of you... I have, but 3-factor authentication doesn't prevent duress. If someone puts a gun to your head and tells you to enter your password + SecureID + retinal scan, what are you going to do? > The irony is that millions of years of evolution has given us humans > so much built-in natural hardware for authentication that we're now > doomed to underestimate the inherent complexity and subtlety of the > problem. That was sort of my point. The problem is so complex that there is no silver bullet solution. The only thing that we can do is incrementally improve our solutions. Using a hash of a retinal scan as a passphrase in order to make public key cryptography more mainstream could be a good thing compared to what we have now. It wouldn't be perfect, but questions like "do you trust the hardware" are not unique to this solution. You could pose the same question about using a keyboard to enter a password.
- thwarted 15y ago
  Other than the current obvious UX deficiencies of installing and using them, a client certificate might help people like your mother-in-law. But one would ideally have a passphrase on their private key. If you can't remember a passphrase, the "something you know" portion of "something you know and something you have" is kind of out.
  - pyre 15y ago
    I'm thinking that he/she was meaning that she can't remember a passphrase so would end up only using a weak password.
- enneff 15y ago
  How about 2-factor authentication, as discussed in the article?
  - kristofferR 15y ago
    SMS is not global and is quite expensive to get started with. Only the major players like Google can roll out worldwide SMS authentication. Email is out of the question because it often takes several minutes to receive an email (due to POP-fetching intervals etc)
    - sweis 15y ago
      Google supports HOTP-based codes that can be generated by a mobile application or even a local bookmarklet. They also support printed one-time codes. Here's the open source project for the mobile app and PAM module: http://code.google.com/p/google-authenticator/ http://code.google.com/p/google-authenticator/ (Disclaimer: I worked on this.)
    - jonknee 15y ago
      You don't need to have data access to use Google's two-factor authentication.
    - enneff 15y ago
      The 2-factor auth process doesn't use SMS, it uses a one-time-password generator app that you can run on modern smartphones.
pnathan 15y ago
Practical pubkey verification & authentication requires a repository of public keys. Also, shudder password recovery/reset mechanisms. I spent a few hours thinking about it once: this isn't much different from the DNS problem. If a good distributed DNS system can be developed (ie, highly resistant to malicious poisoning), that algorithm can likely transfer to pubkey archives.

qjz 15y ago

I agree that public key authentication is an improvement over passwords. Now show me a system that my mother-in-law can use (passphrases are out, she can't remember them).

pyre 15y ago
How about adding in another factor of authentication and make the passphrase a hash of data from a biometric scan (e.g. retina scan)?
- marshray 15y ago
  Is it secret? If so, how do you change it if it gets disclosed? If not, how hard is it to make a fake eyeball? How do you know the user's actually being authenticated and it's not just a replay of a previously captured image? Do you require a trusted hardware scanner now? If so, how do you deploy it to all your users? How do you keep the attacker from taking it apart and reverse engineering it? But most of all, how do you know the user is actually intending to authenticate the thing that is being authenticated? E.g. the user is wants to open door A so they put their eyeball up to the scanner, but the bad guy has installed a skimmer (like on ATMs) which replays the users retina and lets him into door B. Biometrics usually raise more questions than answers IMHO.
  - pyre 15y ago
    Awesome. I'm so glad that you have shown me the light. I now realize that we are perfectly and 100% secure right this very moment and that the security system of using the same password everywhere (e.g. password = 'password') is working out so well for people! [Also: If a user enters <FORM OF AUTHENTICATION>, how do we know for sure that they aren't entering <FORM OF AUTHENTICATION> under duress? We'd better just scrap this whole authentication thing altogether.]
    - marshray 15y ago
      I now realize that we are perfectly and 100% secure right this very moment Lol. :-) If a user enters <FORM OF AUTHENTICATION>, how do we know for sure that they aren't entering <FORM OF AUTHENTICATION> under duress? Haven't you heard of the three factors of authentication? Something they steal, something they chop off, and something they beat out of you... We'd better just scrap this whole authentication thing altogether. You can't. It's a fundamental activity, as old as the the first cell membrane (this is me, this is not me). Multicellular organisms have immune systems (which are often fooled). Babies (sometimes switched at birth) recognize their mother's voices right when they're born. Ever visit another city and people there can just tell right away you're from out-of-town? The irony is that millions of years of evolution has given us humans so much built-in natural hardware for authentication that we're now doomed to underestimate the inherent complexity and subtlety of the problem.
      - pyre 15y ago
        > Haven't you heard of the three factors of authentication? > > Something they steal, something they chop off, and something they > beat out of you... I have, but 3-factor authentication doesn't prevent duress. If someone puts a gun to your head and tells you to enter your password + SecureID + retinal scan, what are you going to do? > The irony is that millions of years of evolution has given us humans > so much built-in natural hardware for authentication that we're now > doomed to underestimate the inherent complexity and subtlety of the > problem. That was sort of my point. The problem is so complex that there is no silver bullet solution. The only thing that we can do is incrementally improve our solutions. Using a hash of a retinal scan as a passphrase in order to make public key cryptography more mainstream could be a good thing compared to what we have now. It wouldn't be perfect, but questions like "do you trust the hardware" are not unique to this solution. You could pose the same question about using a keyboard to enter a password.
thwarted 15y ago
Other than the current obvious UX deficiencies of installing and using them, a client certificate might help people like your mother-in-law. But one would ideally have a passphrase on their private key. If you can't remember a passphrase, the "something you know" portion of "something you know and something you have" is kind of out.
- pyre 15y ago
  I'm thinking that he/she was meaning that she can't remember a passphrase so would end up only using a weak password.
enneff 15y ago
How about 2-factor authentication, as discussed in the article?
- kristofferR 15y ago
  SMS is not global and is quite expensive to get started with. Only the major players like Google can roll out worldwide SMS authentication. Email is out of the question because it often takes several minutes to receive an email (due to POP-fetching intervals etc)
  - sweis 15y ago
    Google supports HOTP-based codes that can be generated by a mobile application or even a local bookmarklet. They also support printed one-time codes. Here's the open source project for the mobile app and PAM module: http://code.google.com/p/google-authenticator/ http://code.google.com/p/google-authenticator/ (Disclaimer: I worked on this.)
  - jonknee 15y ago
    You don't need to have data access to use Google's two-factor authentication.
  - enneff 15y ago
    The 2-factor auth process doesn't use SMS, it uses a one-time-password generator app that you can run on modern smartphones.

pnathan 15y ago

Practical pubkey verification & authentication requires a repository of public keys. Also, shudder password recovery/reset mechanisms. I spent a few hours thinking about it once: this isn't much different from the DNS problem. If a good distributed DNS system can be developed (ie, highly resistant to malicious poisoning), that algorithm can likely transfer to pubkey archives.