4 ms·

And if their laptop (or smartphone - there are even worse security breaches possible with them) is rooted and keylogged, then both of these things will happen s

And if their laptop (or smartphone - there are even worse security breaches possible with them) is rooted and keylogged, then both of these things will happen simultaneously. And they won't find out right away, either. EDIT: the other problem (again, psychological) is that you can't require users to have a password manager, even if you think it's a good solution, which I personally don't. Your site is not aware if the password came from a manager or from a keyboard. But once you issue security tokens, they must be used. And often, it's not just the user's problem if someone has their password; once someone is in your network, privilege escalation is usually not far away.

troyhunt 15y ago
Ah, this is true but you've just made a very big leap from simply obtaining a password to now successfully installing a rootkit and key logger and obtaining both the keychain and password. We could go back and forth about the likelihood of this on a patched, virus protected machine (ok, there are still zero days), but we're starting to greatly reduce the probability as it is. I'd love to see two factor auth or at least the option of RSA style tokens and we're gradually seeing that in some places but unfortunately we're still stuck with the status quo for the vast majority of sites for the foreseeable future.
- yaakov34 15y ago
  I don't disagree with that, but I am making a different point. Password systems, by their nature, require lots and lots of actions from users: making up passwords, resetting them when expired, making a keyfile and keeping it safe and backed up (if using a password manager), remembering a long and random master password, and the list goes on - e.g. remembering not to reuse passwords or use similar passwords. It's been proven over and over and over and over again that users will not do these things. It's not like password managers are new; they've been around for 15 years, and haven't made a dent. We can keep banging our heads against that wall, or we can give users a solution that doesn't depend on them doing and remembering dozens of technical actions. "This is the key to your bank account. Don't lose it, but if you do, call us." This can work. And from a technical point of view, all password systems have a weakness of having long-term credentials - a stolen password can be used for months, at any time, until it expires. That part is not fixable.
Vitaly 15y ago
if your laptop is rooted and keylogged, you are going to loose access to all accounts you actually use anyway, which probably means the most important ones: your email, your bank, your openid. Oh, and you won't find out right away, either.
- yaakov34 15y ago
  Not precisely. Sure, with a session open on your computer and the token inserted, anyone controlling the computer controls the session. But once you close the laptop or take out the key, the access is gone (this is how it works with the most up-to-date challenge-response systems). And yes, you will find out soon, since the results of the recent active session will be all wrong. An attacker can't use the credentials at a later date. I am not saying this is perfect (no security will ever be), but it's stronger than long-term passwords, with or without a password manager. Even for credentials for multiple sites stored on one token (which is less safe), you at least get the ability - even offline - to see what credentials have been provided to whom. It's just a fundamentally better authentication paradigm, although certainly not the solution to all the world's security ills.
  - true_religion 15y ago
    If you're giving the computer, your cryptographic keys from your security token in order to start a session then a malicious program on a rooted machine will have access to them too.
    - onemoreact 15y ago
      Good tokens don't work that way. Normally your giving out a 5-10 digit code that is valid for 30 seconds and can be compared with a secure server somewhere. Physical devices plugged into the machine often work the same way, but use a longer code that you don't need to enter. In either case the token never gives up it's private key's.
  - acdha 15y ago
    No one is questioning that it's better, just whether it makes sense to conflate a still unfortunately hypothetical system with something immediately available. Until the US financial system starts taking security seriously, I can't force them to switch to token-based auth but I can start using a password manager. I also find the distinction above almost meaningless for webapps: if an attacker has privileged access, you're screwed. Maybe they can't make actions while you're not logged in but they can hijaack the session and control everything you see each time you do login. Using a more trustworthy client is your only realistic option until banks start requiring one-time codes for every transaction.
evandijk70 15y ago
Pokerstars, the biggest company offering online poker, has an optional RSA token you can use to login. This way, the users can pick their own solution

troyhunt 15y ago

Ah, this is true but you've just made a very big leap from simply obtaining a password to now successfully installing a rootkit and key logger and obtaining both the keychain and password. We could go back and forth about the likelihood of this on a patched, virus protected machine (ok, there are still zero days), but we're starting to greatly reduce the probability as it is. I'd love to see two factor auth or at least the option of RSA style tokens and we're gradually seeing that in some places but unfortunately we're still stuck with the status quo for the vast majority of sites for the foreseeable future.

yaakov34 15y ago
I don't disagree with that, but I am making a different point. Password systems, by their nature, require lots and lots of actions from users: making up passwords, resetting them when expired, making a keyfile and keeping it safe and backed up (if using a password manager), remembering a long and random master password, and the list goes on - e.g. remembering not to reuse passwords or use similar passwords. It's been proven over and over and over and over again that users will not do these things. It's not like password managers are new; they've been around for 15 years, and haven't made a dent. We can keep banging our heads against that wall, or we can give users a solution that doesn't depend on them doing and remembering dozens of technical actions. "This is the key to your bank account. Don't lose it, but if you do, call us." This can work. And from a technical point of view, all password systems have a weakness of having long-term credentials - a stolen password can be used for months, at any time, until it expires. That part is not fixable.

Vitaly 15y ago

if your laptop is rooted and keylogged, you are going to loose access to all accounts you actually use anyway, which probably means the most important ones: your email, your bank, your openid. Oh, and you won't find out right away, either.

yaakov34 15y ago
Not precisely. Sure, with a session open on your computer and the token inserted, anyone controlling the computer controls the session. But once you close the laptop or take out the key, the access is gone (this is how it works with the most up-to-date challenge-response systems). And yes, you will find out soon, since the results of the recent active session will be all wrong. An attacker can't use the credentials at a later date. I am not saying this is perfect (no security will ever be), but it's stronger than long-term passwords, with or without a password manager. Even for credentials for multiple sites stored on one token (which is less safe), you at least get the ability - even offline - to see what credentials have been provided to whom. It's just a fundamentally better authentication paradigm, although certainly not the solution to all the world's security ills.
- true_religion 15y ago
  If you're giving the computer, your cryptographic keys from your security token in order to start a session then a malicious program on a rooted machine will have access to them too.
  - onemoreact 15y ago
    Good tokens don't work that way. Normally your giving out a 5-10 digit code that is valid for 30 seconds and can be compared with a secure server somewhere. Physical devices plugged into the machine often work the same way, but use a longer code that you don't need to enter. In either case the token never gives up it's private key's.
- acdha 15y ago
  No one is questioning that it's better, just whether it makes sense to conflate a still unfortunately hypothetical system with something immediately available. Until the US financial system starts taking security seriously, I can't force them to switch to token-based auth but I can start using a password manager. I also find the distinction above almost meaningless for webapps: if an attacker has privileged access, you're screwed. Maybe they can't make actions while you're not logged in but they can hijaack the session and control everything you see each time you do login. Using a more trustworthy client is your only realistic option until banks start requiring one-time codes for every transaction.

evandijk70 15y ago

Pokerstars, the biggest company offering online poker, has an optional RSA token you can use to login. This way, the users can pick their own solution