Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 10 Jun 2016 17:21:16 +0200
From: "" <>
Subject: Re: Authentication vs Identification

On 06/10/2016 04:36 PM, Jeffrey Goldberg wrote:
> On 2016-06-10, at 6:17 AM, wrote:
> [Snipping a long, but important, rant about the errors of confusing identifiers with authentication.]
>> These characteristic properties are completely mutually exclusive (can you imagine something more mutually exclusive than that?!), this is why you must send to hell everyone who dares to propose you any piece of biometric data as your auth token.
> The examples that I use for the dangers of using (knowledge of) identifiers as proof of authenticity are the history of Social Security numbers in the US and of credit card numbers.

Why do you think I do not have a credit card? :)

I worked "hands-on" with this shit, and used to be involved up to the 
nostrils into this bank-related security theatre. It is a tough 
situation to sort out when every one who works with you is a fraud, and 
the biggest fraud is the anti-fraud department chief. (Also they are all 
imbeciles in my personal experience.)

Another side of the story is a Layman.
There is no way to explain an ordinary citizen that he is fucked up.
-- Everybody uses it!
-- I am not important.
-- It can't be true, because my bank consultant said otherwise.
-- What do you think all these numbers are for? fun?
-- I have an additional layer of "security" in my contract.

> Social Security numbers are record locators,

this adds another layer of vulnerability.
in a normal guessing attack a bad guy must locate a single record and 
then is "allowed" to guess a password.
in a single-token situation the attack is automatically applied to the 
ENTIRE DATABASE: whatever record matches the guess.

> but when retail banks in the US started offering some banking services by phone,

i have an anecdote from my personal exp.
our office was under security alarm system, and i happened to arrive 
before anyone else deactivated the system, i knew the algorithm but had 
no exp, consequently i set off the alarm.
Then I immediately called the security to revoke the alarm.
For this particular case there was a password, which was as usual 
written by call centre girls on a wall. I knew the location, but again 
had no exp. The wall appeared to be CLUTTERED WITH PASSWORDS. I picked 
one at random, and failed, i picked another one and failed again, and 
again... until the girl on the other end of the line get annoyed by me. 
She cried:
-- What an idiot! your password is "XYZ!@#", is it so fucking difficult 
to remember? Good day.

The alarm was revoked.

> (late night TV adverts in the US in the 1970s and 1980s) that knowledge of a credit card number was used for authentication.

they are not to blame.
who ALLOWED THEM to run those transactions?
and after this decision the banks demand a right to shift the fraudulent 
transaction risks from self to the clients.
they accept FUNDAMENTALLY INSECURE transactions and then play innocent,
and no single layman ever questioned them.
who is responsible for setting up a flawed system? HACKERS!


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.