3 ms·
> It’s strange that we still haven’t setup any sort of authenticated form of communication with official parties. My alarm company had me come up with challeng
by magicalhippo 9mo ago
> It’s strange that we still haven’t setup any sort of authenticated form of communication with official parties.
My alarm company had me come up with challenge and response words. Yet when they call they want me to say my word first. Like how do I know they are who they say they are? Caller ID can easily be spoofed.
So so much for that idea...
- mindslight 9mo agoThe security model here is different than usual. The goal of the challenge is to authenticate you to them - in case they are calling a landline, or a left-at-home mobile phone that the burglar is now answering. So this actually makes sense. If they call, you say you word, then they can't authenticate themselves to you, it seems like you must then change your word. For active man-in-the-middle, I don't think this protocol is designed to protect against that.