WebApp Sec mailing list archives
RE: Two-Factor Authentication on the Web
From: "James Pujals" <james.pujals () sterlingpayment com>
Date: Fri, 30 Jun 2006 15:26:27 -0400
Hello: But even when biometric authentication "works", it still does not prove my _identity_, it just proves that I am who *I said* I am, which is another thing entirely; and some might say is its most obvious point of failure. What's worse, as opposed to other 2-factor authentication methods (e.g. something I have, something I know), the "something I have" with biometrics, or as you say the "something I am" is not easily or practically replaceable if by chance it gets subverted. And thus, given its inherent value and importance to its owner (I'm pretty sure we all want to keep all our fingers, eyes, etc.), the more value placed on the payload it guards (i.e. bank account, medical records, credit history, etc.), the higher the risk increases for its owner; as not only can someone clean up your savings account, but they will necessarily have to kill, maim, or otherwise molest of you in the process. -dZ. ________________________________ From: Tim [mailto:pand0ra.usa () gmail com] Sent: Fri 06/30/2006 11:45 To: Andrew van der Stock Cc: Webappsec Mail List Subject: Re: Two-Factor Authentication on the Web What I was trying to say is that you can only authenticate someone through biometrics because it is something that they are. I do not dispute that technology can be subverted or that people can be manipulated. What I am trying to say is that a label (name, ssn) cannot be trusted, especially nowadays. I feel the same in that regristration would have to be done in person but again that is impractical. Again, I am not saying that the current biometrics technology is an adequate solution. Just that the concept of biometrics is the only way to validate someone's identity. You seem to be very familiar with biometrics, can you provide some examples of products that you have experience with that you would consider to be a scam and what ones (regardless of expense) are adequate? ------------------------------------------------------------------------- Sponsored by: Watchfire As web applications become increasingly complex, tremendous amounts of sensitive data - personal, medical and financial - are exchanged, and stored. Consumers expect and demand security for this information. This whitepaper examines a few vulnerability detection methods - specifically comparing and contrasting manual penetration testing with automated scanning tools. Download "Automated Scanning or Manual Penetration Testing?" today! https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm --------------------------------------------------------------------------
Current thread:
- Re: Two-Factor Authentication on the Web, (continued)
- Re: Two-Factor Authentication on the Web Saqib Ali (Jun 28)
- RE: Two-Factor Authentication on the Web Harper.Matthew (Jun 28)
- Re: Two-Factor Authentication on the Web Tim (Jun 29)
- Re: Two-Factor Authentication on the Web Pete Herzog (Jun 30)
- RE: Two-Factor Authentication on the Web LM (Jun 30)
- Re: Two-Factor Authentication on the Web Tim (Jun 29)
- Re: Two-Factor Authentication on the Web Nick Owen (Jun 29)
- Re: Two-Factor Authentication on the Web Tim (Jun 30)
- RE: Two-Factor Authentication on the Web Christian Kanakis (Jun 30)
- Re: Two-Factor Authentication on the Web Andrew van der Stock (Jun 30)
- Re: Two-Factor Authentication on the Web Tim (Jun 30)
- RE: Two-Factor Authentication on the Web James Pujals (Jun 30)
- Re: Two-Factor Authentication on the Web Tim (Jun 30)