4 ms·

Makes me think of Steve Gibsons Security Now episode on the 4 factors of security: 1: Something you know (Password) 2: Something you have (OTP) 3: Something

Makes me think of Steve Gibsons Security Now episode on the 4 factors of security: 1: Something you know (Password) 2: Something you have (OTP) 3: Something you are (Bio) 4: Someone you know (3rd Party) In 2024, the last 2 seem a bit more challenging. With AI voice and biometric data being able to be lifted from internet media, there's some more to think about when designing these systems. These are fun challenges to think about. I'm glad Steve decided to break the 1000 podcast limit, I highly recommend checking it currently along with the archive.

Detrytus 3y ago
Seems like it's 2024 and still nothing can beat a complex password saved in a password manager. With OTP as a good way of annoying users, and other ones being totally useless.
- stees 3y ago
  definitely not, adding in a second factor such as fido u2f provides unique passwords per domain, which levels up security against phishing attacks!
  - Detrytus 3y ago
    The problem I have with hardware based authentication, such as Yubikey is that it's a physical thing that can be taken away from you (or just break, or get lost), which makes me nervous. Maybe it's stupid, but the scenario I always have in mind is one from "Bourne Identity" movie, with Jason Bourne found in the sea, with nothing on him, no wallet, no phone. And it's not far fetched scenario either: I travel a lot, internationally, so I always imagine being mugged, having my phone and wallet taken away from me. Being able to login to my accounts, and more importantly, access my money in the bank with nothing but a password stored in my brain is important to me.
    - mysteria 3y ago
      A lot of places with hardware authentication will provide a recovery key you can store somewhere you can access (e.g. as an encrypted file on an cloud storage service with no 2FA/geolockouts). Obviously the passwords for the file and the service are memorized. If all your possessions are stolen you could say use a borrowed computer to access that file and bootstrap yourself. For services with TOTP you can store the secret in that encrypted file, so you can reload it back into your authenticator app. Or you could just use a Keepass file or similar which would store all the passwords and keys in a single encrypted binary.
      - LegionMammal978 3y ago
        > For services with TOTP you can store the secret in that encrypted file, so you can reload it back into your authenticator app. Though you do have to be very circumspect in choosing that app: the news of Authy's desktop app (which you could pull the tokens from) being discontinued is still fresh in my mind.
        Detrytus 3y ago
        I recently discovered that KeePassX can be used to generate TOTP, and it is open source
  - EvanAnderson 3y ago
    > ...adding in a second factor such as fido u2f provides unique passwords per domain... Properly using a password manager provides unique passwords per domain too.
  - pepa65 3y ago
    Passwords can be backed up in many places, this is much harder with the fido u2f.
d-lisp 3y ago
Thinking about this, I observe that the problem of the factors of security is in fact tied to the problem of identifying someone : If you can prove that "someone/something" is "you", then you are giving "someone/something" the permissions to act as "you". There are lots of tricks we invented to evade the problem; I am pretty sure our common knowledge (yours and mine) of these tricks includes the one about "knocking three time on the door in a specific rythm" or the one about "You will ask this specific question and I will answer with that exact sentence". I would like to enquire about the problems of security and identification; cannot we do better than what we're currently doing, and why is it that any effort we do aiming for better resembles these tricks I talked about ? What's funny about this problems is the fact that in the context of everyday life, you sometimes prove that you are you by showing e.g. an ID card to a police officer. If I had a twin, that twin could do a lot of things as me, he could do nice things, but he could also do bad things. What would stop my twin from being identified as me by others would be the fact e.g. he doesn't possess my ID card; but a card can be stolen (OTP). My evil twin could also be suspected of not being me if for example, he didn't know something people know I know; it could also be mistaken for silliness, but okay. He could learn everything I know, or be spying on me enough so that he knows what I know (Password). When no one doubts about you being you, it means that everyone agrees with the fact that you are yourself, i.e. every "party" identify you as yourself, and the fact that every other party is identifying you as yourself makes individual parties even more sure that you are yourself. But on what evidences rely the third parties confidence in you being you ? How can you trust that third parties aren't corrupted or mistaken ? Take the most extreme case : you must tell if someone is lying or not about its identity AND if you're wrong, you die. I could trust third parties only if they brang some crucial facts; passwords and possession are unsignificant evidences in that context. But if the quantity of third party is enough, and if each third party knows a different passord AND if you know a different password AND the person to identify gave the correct answer for each and everyone of them, it is becoming more and more unprobable that the person is not the one they claimed to be. But I am not satisfied with this, there must be some more elegant and trustful way of identifying people. Now that we're able to imitate the voice, fingerprints, and etc... what other trick can we find that is not a trick ?
- LegionMammal978 3y ago

Detrytus 3y ago

Seems like it's 2024 and still nothing can beat a complex password saved in a password manager. With OTP as a good way of annoying users, and other ones being totally useless.

stees 3y ago
definitely not, adding in a second factor such as fido u2f provides unique passwords per domain, which levels up security against phishing attacks!
- Detrytus 3y ago
  The problem I have with hardware based authentication, such as Yubikey is that it's a physical thing that can be taken away from you (or just break, or get lost), which makes me nervous. Maybe it's stupid, but the scenario I always have in mind is one from "Bourne Identity" movie, with Jason Bourne found in the sea, with nothing on him, no wallet, no phone. And it's not far fetched scenario either: I travel a lot, internationally, so I always imagine being mugged, having my phone and wallet taken away from me. Being able to login to my accounts, and more importantly, access my money in the bank with nothing but a password stored in my brain is important to me.
  - mysteria 3y ago
    A lot of places with hardware authentication will provide a recovery key you can store somewhere you can access (e.g. as an encrypted file on an cloud storage service with no 2FA/geolockouts). Obviously the passwords for the file and the service are memorized. If all your possessions are stolen you could say use a borrowed computer to access that file and bootstrap yourself. For services with TOTP you can store the secret in that encrypted file, so you can reload it back into your authenticator app. Or you could just use a Keepass file or similar which would store all the passwords and keys in a single encrypted binary.
    - LegionMammal978 3y ago
      > For services with TOTP you can store the secret in that encrypted file, so you can reload it back into your authenticator app. Though you do have to be very circumspect in choosing that app: the news of Authy's desktop app (which you could pull the tokens from) being discontinued is still fresh in my mind.
      - Detrytus 3y ago
        I recently discovered that KeePassX can be used to generate TOTP, and it is open source
- EvanAnderson 3y ago
  > ...adding in a second factor such as fido u2f provides unique passwords per domain... Properly using a password manager provides unique passwords per domain too.
- pepa65 3y ago
  Passwords can be backed up in many places, this is much harder with the fido u2f.

d-lisp 3y ago

Thinking about this, I observe that the problem of the factors of security is in fact tied to the problem of identifying someone : If you can prove that "someone/something" is "you", then you are giving "someone/something" the permissions to act as "you". There are lots of tricks we invented to evade the problem; I am pretty sure our common knowledge (yours and mine) of these tricks includes the one about "knocking three time on the door in a specific rythm" or the one about "You will ask this specific question and I will answer with that exact sentence". I would like to enquire about the problems of security and identification; cannot we do better than what we're currently doing, and why is it that any effort we do aiming for better resembles these tricks I talked about ? What's funny about this problems is the fact that in the context of everyday life, you sometimes prove that you are you by showing e.g. an ID card to a police officer. If I had a twin, that twin could do a lot of things as me, he could do nice things, but he could also do bad things. What would stop my twin from being identified as me by others would be the fact e.g. he doesn't possess my ID card; but a card can be stolen (OTP). My evil twin could also be suspected of not being me if for example, he didn't know something people know I know; it could also be mistaken for silliness, but okay. He could learn everything I know, or be spying on me enough so that he knows what I know (Password). When no one doubts about you being you, it means that everyone agrees with the fact that you are yourself, i.e. every "party" identify you as yourself, and the fact that every other party is identifying you as yourself makes individual parties even more sure that you are yourself. But on what evidences rely the third parties confidence in you being you ? How can you trust that third parties aren't corrupted or mistaken ? Take the most extreme case : you must tell if someone is lying or not about its identity AND if you're wrong, you die. I could trust third parties only if they brang some crucial facts; passwords and possession are unsignificant evidences in that context. But if the quantity of third party is enough, and if each third party knows a different passord AND if you know a different password AND the person to identify gave the correct answer for each and everyone of them, it is becoming more and more unprobable that the person is not the one they claimed to be. But I am not satisfied with this, there must be some more elegant and trustful way of identifying people. Now that we're able to imitate the voice, fingerprints, and etc... what other trick can we find that is not a trick ?

LegionMammal978 3y ago