Image-based authentication is certainly an important part of helping with
customer confidence in the web-application they are accessing.
By allowing the user to view a known/selected/chosen/uploaded photo before
entering their second round of authentication information (e.g. Round One =
Surname and Online Reference number -- Round Two = Pin code and random parts
of their shared password) they can help be assured that they are at least
connected to their real web-application [yes, I know that any transparent
proxying will defeat this - but MITM is difficult to prevent from the
client end].
I have been recommending this process to my financial clients for several
years now... And have seen some good implementations of it in Europe.
For some more information on this see
http://www.technicalinfo.net/papers/Phishing6.html#3.3.3.CustomWebApplicatio
nSecurity
Cheers,
Gunter
-----Original Message-----
From: Dave Jevans [mailto:djevans@teros.com]
Sent: 29 November 2004 22:55
To: Michael Silk; webappsec@securityfocus.com; mb@xato.net
Subject: RE: Article - A solution to phishing
Imaged based mutual auth a la passmark can also authenticate
the site to the user.
-----Original Message-----
From: Michael Silk [mailto:michaelsilk@gmail.com]
Sent: Monday, November 29, 2004 2:07 PM
To: webappsec@securityfocus.com; mb@xato.net
Subject: RE: Article - A solution to phishing
Hi Mark,
Re "authenticating the site".
I considered this option, and came up with a few ideas
- basically the site would post questions _AND_ answers to
the user before allowing him/her to enter their password.
Example:
"Hi Jones, your surname is 'InTheFastLane'.".
"Your favourite movie is Rambo".
"Etc".
This way, a phishing site couldn't possibly know the
answers so they would be incorrect.
However, and obviously, it's can be MITM'd easily.
I couldn't think of any other possibilities to ensure
the site is the correct site before the user enters there
password other then that which I proposed.
-- Michael
-----Original Message-----
From: Mark Burnett [mailto:mb@xato.net]
Sent: Tuesday, 30 November 2004 3:15 AM
To: webappsec@securityfocus.com
Subject: Re: Article - A solution to phishing
I have been watching this thread with great interest and
although the basic concept that Michael describes is
interesting and might help reduce phishing, as others have
pointed out it is still vulnerable to a number of other
threats and heavily depends on a number of assumptions that
might not be realistic.
Nevertheless, the fundamental issue with phishing is not that
an attacker can obtain your credentials, but that an attacker
can trick a user into entering credentials in a fake web
form. This is because it is easy to create a fake web site
that looks exactly like the original and it is easy to direct
the user to that site using deceptive links in e-mails,
browser vulnerabilities, DNS spoofing or poisoning, ARP
spoofing, stealth proxies, cross-site scripting, HOSTS file
modification, bookmark modification, trojans, social engineering, etc.
Protecting authentication credentials is also a problem, but
the solution to phishing is more one of authenticating the
site rather than authenticating the user. First solving the
issue of authenticating the site makes it easier to solve the
problem of authenticating the user.
Mark Burnett
------------------------------------------------------------------
Hacking the Code: ASP.NET Web Application Security
http://www.hackingthecode.com
