5 ms·

I agree that public key authentication is an improvement over passwords. Now show me a system that my mother-in-law can use (passphrases are out, she can't reme

by qjz 15y ago

I agree that public key authentication is an improvement over passwords. Now show me a system that my mother-in-law can use (passphrases are out, she can't remember them).

pyre 15y ago
How about adding in another factor of authentication and make the passphrase a hash of data from a biometric scan (e.g. retina scan)?
- marshray 15y ago
  Is it secret? If so, how do you change it if it gets disclosed? If not, how hard is it to make a fake eyeball? How do you know the user's actually being authenticated and it's not just a replay of a previously captured image? Do you require a trusted hardware scanner now? If so, how do you deploy it to all your users? How do you keep the attacker from taking it apart and reverse engineering it? But most of all, how do you know the user is actually intending to authenticate the thing that is being authenticated? E.g. the user is wants to open door A so they put their eyeball up to the scanner, but the bad guy has installed a skimmer (like on ATMs) which replays the users retina and lets him into door B. Biometrics usually raise more questions than answers IMHO.
  - pyre 15y ago
    Awesome. I'm so glad that you have shown me the light. I now realize that we are perfectly and 100% secure right this very moment and that the security system of using the same password everywhere (e.g. password = 'password') is working out so well for people! [Also: If a user enters <FORM OF AUTHENTICATION>, how do we know for sure that they aren't entering <FORM OF AUTHENTICATION> under duress? We'd better just scrap this whole authentication thing altogether.]
    - marshray 15y ago
      I now realize that we are perfectly and 100% secure right this very moment Lol. :-) If a user enters <FORM OF AUTHENTICATION>, how do we know for sure that they aren't entering <FORM OF AUTHENTICATION> under duress? Haven't you heard of the three factors of authentication? Something they steal, something they chop off, and something they beat out of you... We'd better just scrap this whole authentication thing altogether. You can't. It's a fundamental activity, as old as the the first cell membrane (this is me, this is not me). Multicellular organisms have immune systems (which are often fooled). Babies (sometimes switched at birth) recognize their mother's voices right when they're born. Ever visit another city and people there can just tell right away you're from out-of-town? The irony is that millions of years of evolution has given us humans so much built-in natural hardware for authentication that we're now doomed to underestimate the inherent complexity and subtlety of the problem.
      - pyre 15y ago
        > Haven't you heard of the three factors of authentication? > > Something they steal, something they chop off, and something they > beat out of you... I have, but 3-factor authentication doesn't prevent duress. If someone puts a gun to your head and tells you to enter your password + SecureID + retinal scan, what are you going to do? > The irony is that millions of years of evolution has given us humans > so much built-in natural hardware for authentication that we're now > doomed to underestimate the inherent complexity and subtlety of the > problem. That was sort of my point. The problem is so complex that there is no silver bullet solution. The only thing that we can do is incrementally improve our solutions. Using a hash of a retinal scan as a passphrase in order to make public key cryptography more mainstream could be a good thing compared to what we have now. It wouldn't be perfect, but questions like "do you trust the hardware" are not unique to this solution. You could pose the same question about using a keyboard to enter a password.
        marshray 15y ago
        If someone puts a gun to your head and tells you to enter your password + SecureID + retinal scan, what are you going to do? Wish I'd never agreed to the biometric factor. That was sort of my point. Look dude, I may agree with you, but don't expect me to defend to the death your right to say it. Well, maybe this time, but just this once, OK? :-) The problem is so complex that there is no silver bullet solution. The only thing that we can do is incrementally improve our solutions. An important thing to recognize here is that there are often multiple stakeholders involved, sometimes with competing interests. E.g., your bank, your employer, or your email provider's website... and you. There's not always agreement on what constitutes improvement. An employer may love the biometrics idea, but as you point out, it could easily make its employees targets of physical violence. Typically the party that chooses the authentication scheme is the one that writes the check for it. This is not always the party with the most to lose and is almost never the actual user being authenticated. Using a hash of a retinal scan as a passphrase in order to make public key cryptography more mainstream could be a good thing compared to what we have now." I disagree, but you haven't described anything concrete enough for us to discuss. It wouldn't be perfect, but questions like "do you trust the hardware" are not unique to this solution. You could pose the same question about using a keyboard to enter a password.* Right. People get their keystrokes captured all the time, so unless your solution addresses the common issues too it's not worth going inside the eyeball for it. At least passwords are easy to change. It seems that widely adopted authentication systems can never guarantee a strongly trusted endpoint. It always comes down to trying to lock secrets in some box which is then distributed as widely as possible. This idea has failed every time it's been tried.
thwarted 15y ago
Other than the current obvious UX deficiencies of installing and using them, a client certificate might help people like your mother-in-law. But one would ideally have a passphrase on their private key. If you can't remember a passphrase, the "something you know" portion of "something you know and something you have" is kind of out.
- pyre 15y ago
  I'm thinking that he/she was meaning that she can't remember a passphrase so would end up only using a weak password.
enneff 15y ago
How about 2-factor authentication, as discussed in the article?
- kristofferR 15y ago
  SMS is not global and is quite expensive to get started with. Only the major players like Google can roll out worldwide SMS authentication. Email is out of the question because it often takes several minutes to receive an email (due to POP-fetching intervals etc)
  - sweis 15y ago
    Google supports HOTP-based codes that can be generated by a mobile application or even a local bookmarklet. They also support printed one-time codes. Here's the open source project for the mobile app and PAM module: http://code.google.com/p/google-authenticator/ http://code.google.com/p/google-authenticator/ (Disclaimer: I worked on this.)
  - jonknee 15y ago
    You don't need to have data access to use Google's two-factor authentication.
  - enneff 15y ago
    The 2-factor auth process doesn't use SMS, it uses a one-time-password generator app that you can run on modern smartphones.

by qjz 15y ago

I agree that public key authentication is an improvement over passwords. Now show me a system that my mother-in-law can use (passphrases are out, she can't remember them).

pyre 15y ago

How about adding in another factor of authentication and make the passphrase a hash of data from a biometric scan (e.g. retina scan)?

marshray 15y ago
Is it secret? If so, how do you change it if it gets disclosed? If not, how hard is it to make a fake eyeball? How do you know the user's actually being authenticated and it's not just a replay of a previously captured image? Do you require a trusted hardware scanner now? If so, how do you deploy it to all your users? How do you keep the attacker from taking it apart and reverse engineering it? But most of all, how do you know the user is actually intending to authenticate the thing that is being authenticated? E.g. the user is wants to open door A so they put their eyeball up to the scanner, but the bad guy has installed a skimmer (like on ATMs) which replays the users retina and lets him into door B. Biometrics usually raise more questions than answers IMHO.
- pyre 15y ago
  Awesome. I'm so glad that you have shown me the light. I now realize that we are perfectly and 100% secure right this very moment and that the security system of using the same password everywhere (e.g. password = 'password') is working out so well for people! [Also: If a user enters <FORM OF AUTHENTICATION>, how do we know for sure that they aren't entering <FORM OF AUTHENTICATION> under duress? We'd better just scrap this whole authentication thing altogether.]
  - marshray 15y ago
    I now realize that we are perfectly and 100% secure right this very moment Lol. :-) If a user enters <FORM OF AUTHENTICATION>, how do we know for sure that they aren't entering <FORM OF AUTHENTICATION> under duress? Haven't you heard of the three factors of authentication? Something they steal, something they chop off, and something they beat out of you... We'd better just scrap this whole authentication thing altogether. You can't. It's a fundamental activity, as old as the the first cell membrane (this is me, this is not me). Multicellular organisms have immune systems (which are often fooled). Babies (sometimes switched at birth) recognize their mother's voices right when they're born. Ever visit another city and people there can just tell right away you're from out-of-town? The irony is that millions of years of evolution has given us humans so much built-in natural hardware for authentication that we're now doomed to underestimate the inherent complexity and subtlety of the problem.
    - pyre 15y ago
      > Haven't you heard of the three factors of authentication? > > Something they steal, something they chop off, and something they > beat out of you... I have, but 3-factor authentication doesn't prevent duress. If someone puts a gun to your head and tells you to enter your password + SecureID + retinal scan, what are you going to do? > The irony is that millions of years of evolution has given us humans > so much built-in natural hardware for authentication that we're now > doomed to underestimate the inherent complexity and subtlety of the > problem. That was sort of my point. The problem is so complex that there is no silver bullet solution. The only thing that we can do is incrementally improve our solutions. Using a hash of a retinal scan as a passphrase in order to make public key cryptography more mainstream could be a good thing compared to what we have now. It wouldn't be perfect, but questions like "do you trust the hardware" are not unique to this solution. You could pose the same question about using a keyboard to enter a password.
      - marshray 15y ago
        If someone puts a gun to your head and tells you to enter your password + SecureID + retinal scan, what are you going to do? Wish I'd never agreed to the biometric factor. That was sort of my point. Look dude, I may agree with you, but don't expect me to defend to the death your right to say it. Well, maybe this time, but just this once, OK? :-) The problem is so complex that there is no silver bullet solution. The only thing that we can do is incrementally improve our solutions. An important thing to recognize here is that there are often multiple stakeholders involved, sometimes with competing interests. E.g., your bank, your employer, or your email provider's website... and you. There's not always agreement on what constitutes improvement. An employer may love the biometrics idea, but as you point out, it could easily make its employees targets of physical violence. Typically the party that chooses the authentication scheme is the one that writes the check for it. This is not always the party with the most to lose and is almost never the actual user being authenticated. Using a hash of a retinal scan as a passphrase in order to make public key cryptography more mainstream could be a good thing compared to what we have now." I disagree, but you haven't described anything concrete enough for us to discuss. It wouldn't be perfect, but questions like "do you trust the hardware" are not unique to this solution. You could pose the same question about using a keyboard to enter a password.* Right. People get their keystrokes captured all the time, so unless your solution addresses the common issues too it's not worth going inside the eyeball for it. At least passwords are easy to change. It seems that widely adopted authentication systems can never guarantee a strongly trusted endpoint. It always comes down to trying to lock secrets in some box which is then distributed as widely as possible. This idea has failed every time it's been tried.

thwarted 15y ago

Other than the current obvious UX deficiencies of installing and using them, a client certificate might help people like your mother-in-law. But one would ideally have a passphrase on their private key. If you can't remember a passphrase, the "something you know" portion of "something you know and something you have" is kind of out.

pyre 15y ago
I'm thinking that he/she was meaning that she can't remember a passphrase so would end up only using a weak password.

enneff 15y ago

How about 2-factor authentication, as discussed in the article?

kristofferR 15y ago
SMS is not global and is quite expensive to get started with. Only the major players like Google can roll out worldwide SMS authentication. Email is out of the question because it often takes several minutes to receive an email (due to POP-fetching intervals etc)
- sweis 15y ago
  Google supports HOTP-based codes that can be generated by a mobile application or even a local bookmarklet. They also support printed one-time codes. Here's the open source project for the mobile app and PAM module: http://code.google.com/p/google-authenticator/ http://code.google.com/p/google-authenticator/ (Disclaimer: I worked on this.)
- jonknee 15y ago
  You don't need to have data access to use Google's two-factor authentication.
- enneff 15y ago
  The 2-factor auth process doesn't use SMS, it uses a one-time-password generator app that you can run on modern smartphones.