Re: Username password VS hardware token plus PIN

["Paul D. Robertson" <paul () compuwar net>]

On Tue, 22 Feb 2005 MHawkins () TULLIB COM wrote:

> Hi people,
>
> Here's something I've been wondering for some time now.
>
> What is the value of hardware token with burned in PIN as compared to
> username password (when the password policy is forced strong)?

Well, personally I prefer the time-based tokens to a normal dongle...

> We enforce strong password policy in our organization. So when a user logs
> into the VPN, I am reasonably confident of the validity of the
> authentication mechanism. The only problem is if a user writes down their
> password and keeps it with the laptop or PC. Even then, I am confident that
> XX days later, the password will be different to what they wrote down (ok
> they will just write the new one down).

Bzzzt.  There's also the "get the hash" issue, the "use the same password
for mywebmailprovider.com," the "shoulder surfing" issue, etc.

> I fail to see the benefit of using hardware tokens that rely on a one time
> set PIN number (which seems to be all of them). The one time PIN burned into
> most USB tokens is almost guaranteed to be written down by dumb users
> (unfortunately of which there are many) and so the end result is that the
> USB token, the PIN and the laptop are all in a nice handy easy to steal
> location.

I know when my token isn't there (for reasonably useful values of know and
not there.)  I don't know when my password is lost.  You're also limited
to one compromise at a time.

> I have searched long and hard for a token that can use a username password
> combination along with the PIN but to no avail.
>
> Why are so many organizations intent on using hardware/software tokens? What
> am I missing here?

Time-based tokens, which are essentially one-time passwords.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
paul () compuwar net       which may have no basis whatsoever in fact."
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards