Re: FW: PassMark?

["Josh L. Perrymon" <joshuaperrymon () gmail com>]

I am not impressed with the PassMark solution.  It would be trivial to setup
a script of rotating images that are used by the passmark widget.. then feed
them back to the user and have a script post stating the image that was on
the screen when the user clicked submit..

Also feeding in any 2nd level password..  AND the next code that may change
in 60 seconds..
It would just require the attacker to perform some parts of the attack
manually rather than scripted..

I'm mean--  the more hoops you have to jump through will make it harder to
attack or replicate from a phishing view.. but also making it much more
cumbersome on users.

JP
PacketFocus

I have only spent a few minutes looking at the passmark demo.. so disregard
if I'm way off :)


-----Original Message-----
> *From:* Q-Ball [mailto:qballus () gmail com]
> *Sent:* Tuesday, 13 June 2006 2:28 PM
> *To:* Randal T. Rioux
> *Cc:* full-disclosure () lists grok org uk
> *Subject:* Re: [Full-disclosure] PassMark?
>
> I would agree as well, having recently reviewed them with others in the
> same field. Apart from relying on users to only enter their password if they
> saw an image, the solution heavily relied on cookie usage. This works fine
> for most people but a lot of corporate environments have persistant cookie
> polices so this ends up being an annoyance and ineffective for this segment
> of users. It also makes it susceptible to keystroke loggers due to the ease
> of which the challange can be generated. I'd also have trouble justifying
> this as anything other than a 2 x 1-factor solution and as such it may not
> meet FFIEC guidlines.
> The bigger issue, as with any other web based authentication solutions, is
> what does this protect you against and the answer these days is not a lot.
>
> Q-Ball
>
> On 6/13/06, Randal T. Rioux <randy () procyonlabs com> wrote:
> >
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: RIPEMD160
> >
> > Gary E. Miller wrote:
> > > Yo All!
> > >
> > > I thought I'd actually risk a real security question here.
> > >
> > > Any one seen the "PassMark" ( www.passmarksecurity.com) security
> > system
> > > in action?
> > >
> >
> > Yes.
> >
> > Bank of Bangalore^H^H^H^H^H^H^H^H^HAmerica uses it, as well as a recent
> > financial client corp. of mine.
> >
> > I'm not impressed with it.
> >
> > Randy
> >
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.4.2.2 (GNU/Linux)
> > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
> >
> > iD8DBQFEjjYIRrGMQdCNGUERA5rnAJ94fz+ll9VzSazzp0zfhha8BwQURQCfYch0
> > o6/Swjo9ZIyc4Hsb7223koo=
> > =s8LO
> > -----END PGP SIGNATURE-----
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/