RE: Two-Factor Authentication on the Web

["LM" <cocohill () telus net>]

The best I have seen is the Digital Security Device used in conjunction with
username, password and pin# by www.kmdo.com.  The Pin and DSD#s (changes
every 16 seconds and good for only one access for each number) is never made
available online and does not reside on your computer for others who know
how to access.  I am confident this is 100% secure and access by anyone
other than the user is not possible.   Need to know more?  Go to:
https://app.kmdo.net/servlets/com.komodo.servlet.registration.RegistrationSe
rvlet?a=i

LM

-----Original Message-----
From: Pete Herzog [mailto:lists () isecom org] 
Sent: June 30, 2006 8:36 AM
To: Tim
Cc: Harper.Matthew; RSD; webappsec () securityfocus com
Subject: Re: Two-Factor Authentication on the Web

Hi,

> What other controls, other then multifactor authentication, can
> mitigate that risk?

I was hoping to see a good answer to this question.

While there are quite a few ways one can "authenticate" the root 
problem, to me, is Identification and Authorization which make up 
Authentication.  If the same source for Identification is used and the 
same Authorization means is granted then any additional authentication 
factor really is kind of the same thing over the net.  Sure, a token, 
dongle, fingerprint, timezone, location, software, etc. make things more 
difficult to make the attack, if the attacker can usurp the identity and 
the client, then the attack success is very high.  Meaning, if you break 
into the house and use the banking info on that computer to make the 
attack your success chances will be much higher.

An additional channel whether it be SMS or telephone call-back can 
improve the chances authentication, this is still not even close to the 
type of authentication one can get in person.

Further discussion however, will show that physical presence is often 
over-rated because the people who do the identification and grant 
authorization can also be easily fooled.  Risk of getting caught is not 
much higher for those people but the speed to repercussion is. Over the 
net, there is much less repercussion if denied: the difference between 
"Access Denied" on-line and "Hey, wait a minute while I get my manager" 
(as guard approaches).

I've been doing a lot of researching into Trusted Computing for the 
OpenTC project and it's clear that TC may not have the answer either, 
but it's not as bad.  At least it closes the link between person and 
computer a bit better for the sake of identification.

I am interested in hearing from others though on replacement or 
enhancement security for authentication where identification and 
authorization are not weak links or the speed or level of repercussion 
is up there with the physical world.

-pete.

-------------------------------------------------------------------------
Sponsored by: Watchfire

As web applications become increasingly complex, tremendous amounts of 
sensitive data - personal, medical and financial - are exchanged, and 
stored. Consumers expect and demand security for this information. This 
whitepaper examines a few vulnerability detection methods - specifically 
comparing and contrasting manual penetration testing with automated 
scanning tools. Download "Automated Scanning or Manual Penetration 
Testing?" today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm
--------------------------------------------------------------------------

-- 
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.394 / Virus Database: 268.9.8/380 - Release Date: 30/06/2006
 

-- 
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.394 / Virus Database: 268.9.8/380 - Release Date: 30/06/2006
 


-------------------------------------------------------------------------
Sponsored by: Watchfire

As web applications become increasingly complex, tremendous amounts of 
sensitive data - personal, medical and financial - are exchanged, and 
stored. Consumers expect and demand security for this information. This 
whitepaper examines a few vulnerability detection methods - specifically 
comparing and contrasting manual penetration testing with automated 
scanning tools. Download "Automated Scanning or Manual Penetration 
Testing?" today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm
--------------------------------------------------------------------------