6 ms·

Maybe add one more: Allow user to securely login to websites from virus infested machine in an internet cafe. How do these various systems compare based on th

by 7952 15y ago

Maybe add one more: Allow user to securely login to websites from virus infested machine in an internet cafe. How do these various systems compare based on that law? Google one time password or card space?

marshray 15y ago
So after the user securely logs on the virus can transact with the site using properly authenticated credentials? Unfortunately, this is a very prevalent feature of modern malware. This is seriously important question these days. It's where 'login authentication' ends and 'endpoint security' begins.
- Spearchucker 15y ago
  Authentication is just an assertion of identity. End point security is an obvious consideration. There's also authorisation and perimeter protection. Defence in depth. Layer security like the layers in an onion. That said, economics dictates that you wouldn't spend $20 protecting a $10 asset.
  - marshray 15y ago
    Authentication in general is the process of proving that something is 'true' or 'genuine', in this case an assertion of identity. You say endpoint security is obvious, and I usually agree with you. But I can't count the number of times I've had to retrace this methodically with when talking about systems with very smart people. The distinction between authentication and authorization too. Like you're saying, classical risk management says the $10 asset isn't worth $20 of security. Sony learned the fallacy of that reasoning the hard way. If you have a database of 100K usernames, passwords, and email addresses of folks who entered a contest to win free movie tickets, you might not value that asset particularly highly. But if you don't secure, it properly could cost you $M to clean up later. Personal information doesn't always behave like an typical 'asset'. Sometimes it's more like having a surplus of toxic waste. Shoot, I could talk about this stuff all day. :-)
Spearchucker 15y ago
Neither. Google and identity is a bad idea regardless of the problem you're trying to solve (http://www.identityblog.com/?p=1204 http://www.identityblog.com/?p=1204). It's the worst of the three. OTP is good, but challenge-response is better. Is your OTP from a second factor? Card Space is my personal favourite, but the [card] portability issue hasn't been solved. U-Prove holds promise. CardSpace, with U-Prove and second-factor challenge/response would be awesome :-) So as I said, neither of those is ideal. But then I have solved exactly that problem (securely login to websites from virus infested machine in an internet cafe) before, for the UK MoD. I used identity federation (WS-*), and opted for Chip & PIN authentication on the identity provider side, thereby cutting out replay attacks. The solution is complex, and costs a lot more money than the average web site would be willing to pay. Unless someone credible like the Passport Office or DVLA volunteers as an identity provider. Here's the case study. http://www.microsoft.com/casestudies/Case_Study_Detail.aspx?CaseStudyID=4000003478 http://www.microsoft.com/casestudies/Case_Study_Detail.aspx?....
- 7952 15y ago
  So its an argument about which third party you trust? Google or the DVLA? perhaps people trust google because they have to already. If you are running chrome and using gmail you are implicitly trusting them with your data. I agree that this is a bad way of picking a tehnology. I like the chip and pin approach; its a good solution. Perhaps banks should provide federated login. Do you trust them ? :)
  - Spearchucker 15y ago
    It's about context. I trust my bank for banking. I would trust the DVLA to assert my identity where a directed assertion is required, and where I agree to it. I don't trust Google at all because an ad company has no business looking at my email, let alone asserting my identity to third parties. So technically I don't trust any third party. I trust some of them in varying degrees based on what I'm trying to do.

by 7952 15y ago

marshray 15y ago

So after the user securely logs on the virus can transact with the site using properly authenticated credentials? Unfortunately, this is a very prevalent feature of modern malware. This is seriously important question these days. It's where 'login authentication' ends and 'endpoint security' begins.

Spearchucker 15y ago
Authentication is just an assertion of identity. End point security is an obvious consideration. There's also authorisation and perimeter protection. Defence in depth. Layer security like the layers in an onion. That said, economics dictates that you wouldn't spend $20 protecting a $10 asset.
- marshray 15y ago
  Authentication in general is the process of proving that something is 'true' or 'genuine', in this case an assertion of identity. You say endpoint security is obvious, and I usually agree with you. But I can't count the number of times I've had to retrace this methodically with when talking about systems with very smart people. The distinction between authentication and authorization too. Like you're saying, classical risk management says the $10 asset isn't worth $20 of security. Sony learned the fallacy of that reasoning the hard way. If you have a database of 100K usernames, passwords, and email addresses of folks who entered a contest to win free movie tickets, you might not value that asset particularly highly. But if you don't secure, it properly could cost you $M to clean up later. Personal information doesn't always behave like an typical 'asset'. Sometimes it's more like having a surplus of toxic waste. Shoot, I could talk about this stuff all day. :-)

Spearchucker 15y ago

Neither. Google and identity is a bad idea regardless of the problem you're trying to solve (http://www.identityblog.com/?p=1204 http://www.identityblog.com/?p=1204). It's the worst of the three. OTP is good, but challenge-response is better. Is your OTP from a second factor? Card Space is my personal favourite, but the [card] portability issue hasn't been solved. U-Prove holds promise. CardSpace, with U-Prove and second-factor challenge/response would be awesome :-) So as I said, neither of those is ideal. But then I have solved exactly that problem (securely login to websites from virus infested machine in an internet cafe) before, for the UK MoD. I used identity federation (WS-*), and opted for Chip & PIN authentication on the identity provider side, thereby cutting out replay attacks. The solution is complex, and costs a lot more money than the average web site would be willing to pay. Unless someone credible like the Passport Office or DVLA volunteers as an identity provider. Here's the case study. http://www.microsoft.com/casestudies/Case_Study_Detail.aspx?CaseStudyID=4000003478 http://www.microsoft.com/casestudies/Case_Study_Detail.aspx?....

7952 15y ago
So its an argument about which third party you trust? Google or the DVLA? perhaps people trust google because they have to already. If you are running chrome and using gmail you are implicitly trusting them with your data. I agree that this is a bad way of picking a tehnology. I like the chip and pin approach; its a good solution. Perhaps banks should provide federated login. Do you trust them ? :)
- Spearchucker 15y ago
  It's about context. I trust my bank for banking. I would trust the DVLA to assert my identity where a directed assertion is required, and where I agree to it. I don't trust Google at all because an ad company has no business looking at my email, let alone asserting my identity to third parties. So technically I don't trust any third party. I trust some of them in varying degrees based on what I'm trying to do.