4 ms·
If by 'system' you mean the one the user is authenticating to, then yes, afaik. For one to have data encryption, it'd have to be coupled together with a data en
by wfn 13y ago
If by 'system' you mean the one the user is authenticating to, then yes, afaik. For one to have data encryption, it'd have to be coupled together with a data encryption solution.
If 'system' (in your last sentence) means 'user system' ('has' -> keylogger etc), it's not that simple afaik. There's no way for any eavesdropper (between client and server) to know (from the auth game data the server sends) which parts of the data/exchange signify the password. I think they partly addressed possible password/data correlation attacks over multiple logins -> sets of data, but not sure if in this paper, it's been a while. It's not that trivial as far as I take it.
- anologwintermut 13y agoI meant the former. As far as I recall, the latter may have been possible. Their security model required someone physically authenticate it was a human logging into the system. This was to prevent someone from attaching a computer and using it to fake the responses to the challenges. I assume they were in fact worried it would do so by "learning" the real answer, but I can't recall.