Full Disclosure mailing list archives
RE: Clear text password exposure in Datakey's tokens and smartcards
From: Bart.Lansing () kohls com
Date: Mon, 9 Aug 2004 10:01:07 -0500
Why yes Lyal, it is... Mea culpa...but: TCO is not as simple as you lay it out for your smartcard either. We were apples-to-apples there for a bit...but, let's drive into your purported TCO costs on the smartcard there, shall we? First, you seem to have no back-end administration (this is a self-maintained model you have? please explain how that works) to deal with lost cards, forgotten PINs, failed/trashed hardware, etc. Additionally, in any reasonably sized enterprise, you'll need resources allocated to handle new hires, machine moves, upgrades, etc. If you intend to cost-burden the existing staff that's fine...but it's still there. System integration? You're telling me your smartcard system has none? Unless you just have your system doing authentications at boot, you most certainly do have intergration. If you intend to secure some environments more than others, like, at the application level, you have the same integration issues with either system (and probably worse with yours, as RSA has been banging around at this a long time, and the list of apps that RSA can bolt onto is extensive)...so let's call that a wash too. So let's jack your per-seat price up accordingly, ok? But you know, tell you what, let's leave your TCO where it is and bear in mind that I was responding to a $1000/seat number from you, not the $210 + consultant you just tossed back. (Sorry if this sounds sarcastic, but you've changed the parameters and ommited factors as important to the TCO as I did, and then lowered your number just to sound more cost-effective...not cricket, old boy) Now, let's take a look at a typical RSA solution, street prices, for 250 users, and remember that the cost scales down from here: server software (w/24x7 support), about $20,000 US server hardware (trivial, but let's toss a couple of blades at it just for fun) $10,000 US Cards (generous here, very) @ $70.00 US X 250 = $17,500 US I'm going to burden my existing staff with back-end support and admin, just like you did. So, we have a per-seat, fully burdened TCO of $190/seat In a mobile workforce there are additional benefits as well, Lyal...like not having laptop users lug around a card reader that they have to a) remember, and b) plug in every time they want to use the PC. You may well respond by saying that's trivial...but then, you aren't the user, he won't say that. The easier we can make his use of secure products and systems the more likely he is to use them, would you agree? Bart Lansing Manager, Desktop Services Kohl's IT "Lyal Collins" <lyalc () ozemail com au> wrote on 08/08/2004 02:32:15 AM:
$10 smartcard $200 reader (with pinpad) $500-$1000 to have someone (at consultant dates) spend up to a day installing the necessary proprietary drivers, install batteries (or AC adapter/plugpacks, because Smartcards can require more power than a
serial
port, particularly when just inserted and training the (typically
non-techo)
user on how to use the PINpad. Then 2-3 years later, repeating the whole process again because they upgraded/rebeuilt their machine, and can't get the proporietary drivers
to
talk to the proprietary reader w/PINpad, or to repalce the batteries
etc.
One-time token are so much cheaper, and $120-$150 AUD (about US$80) plus $10-$25k for the server software, and a bunch of people time
deistributing
the right token to the right person, plus system integration etc. Sorry if this sounds sarcastic, but the cost of ownership issue is way
more
complex than just the device unit cost. Lyal -----Original Message----- From: Bart.Lansing () kohls com [mailto:Bart.Lansing () kohls com] Sent: Friday, 6 August 2004 11:54 PM To: bugtraq () securityfocus com; full-disclosure () lists netsys com; full-disclosure-admin () lists netsys com Subject: RE: [Full-disclosure] Clear text password exposure in Datakey's tokens and smartcards Guys... RSA has been doing PIN cards for ages...I don't get the hangup on SmartCards vs "plain old" something you have/something you know two
factor
http://www.rsasecurity.com/node.asp?id=1311 Cost of entry/ownership is nothing remotely close to the $1000 you
mention
Lyal...in fact, it's under 1/10 of that on a per seat basis... Why get hung up on it being a smartcard, when you can do two factor with
a
much lower entry cost and do it, frankly, easier? Bart Lansing Manager, Desktop Services Kohl's IT full-disclosure-admin () lists netsys com wrote on 08/05/2004 08:45:33 PM:This exposure, of PIN compromise, is genric in all smartcard productstoday,unless a dedicated PINpad or biometric-sensor equipped readers are
used
-putting cost of ownership towards $1000 in some cases. PC/SC doesn't help - as a data interfcae API spec, it excludes human interface aspects. STIP (Small Terminal Interoperability Platform at www.stip.org) moves in this direction, but has evolved into manyvariants tointeroperate with proprietary vendors and proprietary industrystandards.The challenges in putting biometric sensors or PINpads onto cardsincludethe need to conform to ISO 7816 for form factor, physical resilienceetc,and that the cards are unpowered. Or, someone redesigns the entire form-factor, user interface model, portability and business model - something that has previously failed to go anywhere. Something like a mobile phone or PDA is a good compromise tool to this overall exposure, imho. Lyal -----Original Message----- From: Kevin Sheldrake [mailto:kev () electriccat co uk] Sent: Thursday, 5 August 2004 8:39 PM To: Toomas Soome; lionel.ferette () belnet be Cc: vuln () hexview com; full-disclosure () lists netsys com; bugtraq () securityfocus com Subject: Re: [Full-disclosure] Clear text password exposure in
Datakey's
tokens and smartcards Surely if the user is entering a passphrase then the same problem
exists
-that of effectively eavesdropping that communication from the
keyboard?
Ignoring the initial expense for a moment, wouldn't it have made a lot
ofsense to include the keypad actually on the cards? Obviously, card readers would need to be contructed such that the keypad part of thecardwould be exposed during use. The keypad security could then rely on
the
tamper resistant properties of the rest of the card. From a costs perspective, I would guess that the actual per-card cost
increase would be minimal if hundreds of millions of these cards were produced. KevLionel Ferette wrote:Note that this is true for almost all card readers on the market,
not
only for Datakey's. Having worked for companies using crypto smart cards, I have conducted a few risk analysis about that. Theconclusionhas always been that if the PIN must be entered from a PC, and the attacker has means to install software on the system (throughdirectedviruses, social engineering, etc), the game's over. The only solution against that problem is to have the PIN entered using a keypad on the reader. Only then does the cost of an attack raise significantly. But that is opening another can of worms,becausethere is (was?) no standard for card readers with attached pin pad(atthe time, PC/SCv2 wasn't finalised - is it?).at least some cards are supporting des passphrases to implementsecuredcommunication channels but I suppose this feature is not that widely
inuse.... how many card owners are prepared to remember both PIN
codes
and passphrases... toomas-- Kevin Sheldrake MEng MIEE CEng CISSP Electric Cat (Bournemouth) Ltd _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.htmlCONFIDENTIALITY NOTICE: This is a transmission from Kohl's Department Stores, Inc. and may contain information which is confidential and proprietary. If you are not the addressee, any disclosure, copying or distribution or
use
of the contents of this message is expressly prohibited. If you have received this transmission in error, please destroy it and notify us immediately at 262-703-7000. CAUTION: Internet and e-mail communications are Kohl's property and Kohl's
reserves
the right to retrieve and read any message created, sent and received. Kohl's reserves the right to monitor messages by authorized Kohl's Associates at any time without any further consent.
CONFIDENTIALITY NOTICE: This is a transmission from Kohl's Department Stores, Inc. and may contain information which is confidential and proprietary. If you are not the addressee, any disclosure, copying or distribution or use of the contents of this message is expressly prohibited. If you have received this transmission in error, please destroy it and notify us immediately at 262-703-7000. CAUTION: Internet and e-mail communications are Kohl's property and Kohl's reserves the right to retrieve and read any message created, sent and received. Kohl's reserves the right to monitor messages by authorized Kohl's Associates at any time without any further consent. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Clear text password exposure in Datakey's tokens and smartcards Bart . Lansing (Aug 09)
- RE: Clear text password exposure in Datakey's tokens and smartcards Lyal Collins (Aug 09)