I guess the big question that you have to answer is why you do not want a
token solution. Is it because tokens have to be maintained or is it just
cost prohibitive?
There are solutions that can do two-factor without a token. You may want to
look into those.
Good luck!
-----Original Message-----
From: Ellis, Steven [mailto:steven.ellis@cgi.com]
Sent: Friday, August 19, 2005 2:04 PM
To: webappsec@securityfocus.org
Subject: RE: Entrust - Identity Guard - Any experience?
Of course you just drop the "what you have" card on the nearest
photocopier and now there are two or more of you. The truth is security
costs and that cost must be justifiable. I could not see this technology
in use at companies that have high value data but a small or medium size
business where money is tight.
Just my $.02
-----Original Message-----
From: Dwayne Taylor [mailto:DTaylor@rdacorp.com]
Sent: August 19, 2005 1:06 PM
To: SB; webappsec@securityfocus.org
Subject: RE: Entrust - Identity Guard - Any experience?
The product link below shows something that focuses more on using a
combination of direct authentication and challenge/response rather than
two factor authentication. True two factor authentication based both on
what a user knows and what a user has (such as an X.509 cert/private key
or device that produces one-time passwords) "black boxes" the "what a
user has" element, so that the user requires the device to satisfy the
requirement of something they have for the second authentication factor.
This product's form of "what a user has" is risky because the
challenge/response values can be easily obtained and used by an attacker
without actually possessing the object required to satisfy the
requirement. Understandably, it looks like this company is trying to
get into the market niche of those who want something stronger than
username/password but something more cost effective than the
smartcard/key fob type solutions that require more $$$$.
My $.02
________________________________
From: SB [mailto:vidyabalaji@gmail.com]
Sent: Fri 2005-08-19 08:21
To: webappsec@securityfocus.org
Subject: Entrust - Identity Guard - Any experience?
Hi!
I am looking for insights from you security professionals into
implementing a two factor option that does not require shipping a
token. Something similar to
http://www.entrust.com/identityguard/index.htm
has anyone had experience with this? Any known security issues with
this approach. This will be in addition to the person's user name and
password.
Thanks very much for your help.
Sri Balaji.
