3 ms·

This is how blizzard (World of Warcraft) authenticators work. It's quite ironic how an online game has strong security mechanisms, yet many tools that people us

by roel_v 15y ago

This is how blizzard (World of Warcraft) authenticators work. It's quite ironic how an online game has strong security mechanisms, yet many tools that people use just as often or more (gmail, facebook, pretty much all SaaS tools, including business) and that are are certainly more 'important' (in an objective sense, I understand that people are more attached to their WoW character than to their customer database) don't.

nerfhammer 15y ago
gmail at least has two-factor authentication http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu... yet my bank's web site, not so much.
patangay 15y ago
Facebook also has this feature. It'll send a SMS with the security code and you'll type in the web UI. Since it's SMS and not an app, it also works on non-smart phones. You need to link a mobile to your Facebook account. https://www.facebook.com/help/?page=132501803490562 https://www.facebook.com/help/?page=132501803490562
InclinedPlane 15y ago
WoW and gmail and other 2-factor authentication use the simpler method, 2-factor authentication using a shared secret that isn't passed over the wire (the seed for a PRNG). However, this method is still vulnerable if a hacker gains access to the seeds on the host computer. This is what happened to RSA recently and it's a very bad thing when it happens. What I was talking about was something different. Public/private key encryption where only the public key is stored on the server. Here's an example scenario: the server generates a random pass-phrase then encrypts it using the public key. The end-user then uses their smartphone where the private key is stored to decrypt the message and return the original pass-phrase back to the server, proving they have the private key. There are similar ways of achieving a similar result that are less cumbersome and awkward. The advantage is that if the public key is leaked it's not a big deal, it can't be used to gain access to the system.

by roel_v 15y ago

nerfhammer 15y ago

gmail at least has two-factor authentication http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu... yet my bank's web site, not so much.

patangay 15y ago

Facebook also has this feature. It'll send a SMS with the security code and you'll type in the web UI. Since it's SMS and not an app, it also works on non-smart phones. You need to link a mobile to your Facebook account. https://www.facebook.com/help/?page=132501803490562 https://www.facebook.com/help/?page=132501803490562

InclinedPlane 15y ago

WoW and gmail and other 2-factor authentication use the simpler method, 2-factor authentication using a shared secret that isn't passed over the wire (the seed for a PRNG). However, this method is still vulnerable if a hacker gains access to the seeds on the host computer. This is what happened to RSA recently and it's a very bad thing when it happens. What I was talking about was something different. Public/private key encryption where only the public key is stored on the server. Here's an example scenario: the server generates a random pass-phrase then encrypts it using the public key. The end-user then uses their smartphone where the private key is stored to decrypt the message and return the original pass-phrase back to the server, proving they have the private key. There are similar ways of achieving a similar result that are less cumbersome and awkward. The advantage is that if the public key is leaked it's not a big deal, it can't be used to gain access to the system.