3 ms·

If you have the option to use RSA SecurID or Gemalto devices (used by Amazon), use them first. RSA SecurID was famously compromised back in 2011: http://en.

If you have the option to use RSA SecurID or Gemalto devices (used by Amazon), use them first. RSA SecurID was famously compromised back in 2011: http://en.wikipedia.org/wiki/SecureID#March_2011_system_compromise http://en.wikipedia.org/wiki/SecureID#March_2011_system_comp... Any system where the manufacturer has a copy of the secret key on the token is theoretically vulnerable to this attack.

lstamour 13y ago
That was bone-headed stupidity. RSA could easily have used more expensive HSM hardware, and the rest of us can spend a grand on two YubiHSMs or equivalent hardware. (Or trust Google's....) There's little excuse to poor secret management if you run your own hardware.
- StavrosK 13y ago
  > (Or trust Google's....) What does that mean? Where do you need to trust Google's?
  - lstamour 13y ago
    I meant, "or trust Google's ability to keep their two factor authentication keys secret (with their Authenticator app)". Though perhaps I also meant using Google Authenticator app with your own keys ... except you'd still need to keep them somewhere, which means ideally an HSM and we're back to square one. :)
    - StavrosK 13y ago
      What do you mean by "their" two factor authentication keys? There are no "their" keys. TOTP/HOTP is an open standard and Google Authenticator is an open source app. You can audit it, or write your own. It's not even that hard to implement.
zobzu 13y ago
Reminder also that OTP is NOT a strong factor, anyways. Even if the manufacturer doesn't hold the secret seed (i.e. the device lets you regenerate it - vendors usually don't let you do that so that you're forced to buy again from them all the time).. so yes, even if they don't hold that secret seed, the target servers hold them. There is no encrypted version of the secret seed. There is no hashed version. You and the opposite party (the server you authenticate to) both have to be in possession of the secret seed. That means if any server containing those keys is compromised, your OTP token is suddenly just paperweight (yeah, people like these crappy analogies, i heard.) Using something like an opengpg smartcard and true challenge/response type authentication is much better than the "2FA" provided by password + OTP. Something you have (the keys on the smartcard), something you know (the passphrase to decrypt those keys), the key never leaves the smartcard, nobody else has your key.
- lstamour 13y ago
  Something you have, something you know ... I can see the utility in requiring just those. But I've found it useful to get messages from service providers when, for instance, my ATM card is used, or when I login at a new computer. So I'd like to add to that list "something you monitor" whether through SMS-based 2FA, push notifications, or just plain emails or further challenges if something looks suspicious (e.g. logins from Africa when I'm also logged in from the US)
  - zobzu 13y ago
    While I don't consider the notifications to be part of the authentication - I agree, yes, notifications are good. We're doing something like that at my company as well (its not a bank or anything). If you log from other countries, have too many repeated failed (or even successful) attempts in a time period, etc. you get notified on a dashboard/you can optin for an email (or /and an email that forwards to your SMSes). then you can decide if/when you want to see it and to notify security if you think there's a problem. saves a lot of time for the sec team as well which only will manually check when the alerts reach a higher threshold.

lstamour 13y ago

That was bone-headed stupidity. RSA could easily have used more expensive HSM hardware, and the rest of us can spend a grand on two YubiHSMs or equivalent hardware. (Or trust Google's....) There's little excuse to poor secret management if you run your own hardware.

StavrosK 13y ago
> (Or trust Google's....) What does that mean? Where do you need to trust Google's?
- lstamour 13y ago
  I meant, "or trust Google's ability to keep their two factor authentication keys secret (with their Authenticator app)". Though perhaps I also meant using Google Authenticator app with your own keys ... except you'd still need to keep them somewhere, which means ideally an HSM and we're back to square one. :)
  - StavrosK 13y ago
    What do you mean by "their" two factor authentication keys? There are no "their" keys. TOTP/HOTP is an open standard and Google Authenticator is an open source app. You can audit it, or write your own. It's not even that hard to implement.

zobzu 13y ago

Reminder also that OTP is NOT a strong factor, anyways. Even if the manufacturer doesn't hold the secret seed (i.e. the device lets you regenerate it - vendors usually don't let you do that so that you're forced to buy again from them all the time).. so yes, even if they don't hold that secret seed, the target servers hold them. There is no encrypted version of the secret seed. There is no hashed version. You and the opposite party (the server you authenticate to) both have to be in possession of the secret seed. That means if any server containing those keys is compromised, your OTP token is suddenly just paperweight (yeah, people like these crappy analogies, i heard.) Using something like an opengpg smartcard and true challenge/response type authentication is much better than the "2FA" provided by password + OTP. Something you have (the keys on the smartcard), something you know (the passphrase to decrypt those keys), the key never leaves the smartcard, nobody else has your key.

lstamour 13y ago
Something you have, something you know ... I can see the utility in requiring just those. But I've found it useful to get messages from service providers when, for instance, my ATM card is used, or when I login at a new computer. So I'd like to add to that list "something you monitor" whether through SMS-based 2FA, push notifications, or just plain emails or further challenges if something looks suspicious (e.g. logins from Africa when I'm also logged in from the US)
- zobzu 13y ago
  While I don't consider the notifications to be part of the authentication - I agree, yes, notifications are good. We're doing something like that at my company as well (its not a bank or anything). If you log from other countries, have too many repeated failed (or even successful) attempts in a time period, etc. you get notified on a dashboard/you can optin for an email (or /and an email that forwards to your SMSes). then you can decide if/when you want to see it and to notify security if you think there's a problem. saves a lot of time for the sec team as well which only will manually check when the alerts reach a higher threshold.