[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <119eba7b-1a21-820e-2203-5e555a775d19@bestmx.net>
Date: Fri, 10 Jun 2016 17:21:16 +0200
From: "e@...tmx.net" <e@...tmx.net>
To: passwords@...ts.openwall.com
Subject: Re: Authentication vs Identification
On 06/10/2016 04:36 PM, Jeffrey Goldberg wrote:
> On 2016-06-10, at 6:17 AM, e@...tmx.net wrote:
>
> [Snipping a long, but important, rant about the errors of confusing identifiers with authentication.]
>
>> These characteristic properties are completely mutually exclusive (can you imagine something more mutually exclusive than that?!), this is why you must send to hell everyone who dares to propose you any piece of biometric data as your auth token.
>
> The examples that I use for the dangers of using (knowledge of) identifiers as proof of authenticity are the history of Social Security numbers in the US and of credit card numbers.
Why do you think I do not have a credit card? :)
I worked "hands-on" with this shit, and used to be involved up to the
nostrils into this bank-related security theatre. It is a tough
situation to sort out when every one who works with you is a fraud, and
the biggest fraud is the anti-fraud department chief. (Also they are all
imbeciles in my personal experience.)
Another side of the story is a Layman.
There is no way to explain an ordinary citizen that he is fucked up.
-- Everybody uses it!
-- I am not important.
-- It can't be true, because my bank consultant said otherwise.
-- What do you think all these numbers are for? fun?
-- I have an additional layer of "security" in my contract.
> Social Security numbers are record locators,
this adds another layer of vulnerability.
in a normal guessing attack a bad guy must locate a single record and
then is "allowed" to guess a password.
in a single-token situation the attack is automatically applied to the
ENTIRE DATABASE: whatever record matches the guess.
> but when retail banks in the US started offering some banking services by phone,
i have an anecdote from my personal exp.
our office was under security alarm system, and i happened to arrive
before anyone else deactivated the system, i knew the algorithm but had
no exp, consequently i set off the alarm.
Then I immediately called the security to revoke the alarm.
For this particular case there was a password, which was as usual
written by call centre girls on a wall. I knew the location, but again
had no exp. The wall appeared to be CLUTTERED WITH PASSWORDS. I picked
one at random, and failed, i picked another one and failed again, and
again... until the girl on the other end of the line get annoyed by me.
She cried:
-- What an idiot! your password is "XYZ!@#", is it so fucking difficult
to remember? Good day.
The alarm was revoked.
> (late night TV adverts in the US in the 1970s and 1980s) that knowledge of a credit card number was used for authentication.
they are not to blame.
who ALLOWED THEM to run those transactions?
and after this decision the banks demand a right to shift the fraudulent
transaction risks from self to the clients.
they accept FUNDAMENTALLY INSECURE transactions and then play innocent,
and no single layman ever questioned them.
who is responsible for setting up a flawed system? HACKERS!
-e
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
