The best I have seen is the Digital Security Device used in conjunction with
username, password and pin# by www.kmdo.com. The Pin and DSD#s (changes
every 16 seconds and good for only one access for each number) is never made
available online and does not reside on your computer for others who know
how to access. I am confident this is 100% secure and access by anyone
other than the user is not possible. Need to know more? Go to:
https://app.kmdo.net/servlets/com.komodo.servlet.registration.RegistrationSe
rvlet?a=i
LM
-----Original Message-----
From: Pete Herzog [mailto:lists@isecom.org]
Sent: June 30, 2006 8:36 AM
To: Tim
Cc: Harper.Matthew; RSD; webappsec@securityfocus.com
Subject: Re: Two-Factor Authentication on the Web
Hi,
What other controls, other then multifactor authentication, can
mitigate that risk?
I was hoping to see a good answer to this question.
While there are quite a few ways one can "authenticate" the root
problem, to me, is Identification and Authorization which make up
Authentication. If the same source for Identification is used and the
same Authorization means is granted then any additional authentication
factor really is kind of the same thing over the net. Sure, a token,
dongle, fingerprint, timezone, location, software, etc. make things more
difficult to make the attack, if the attacker can usurp the identity and
the client, then the attack success is very high. Meaning, if you break
into the house and use the banking info on that computer to make the
attack your success chances will be much higher.
An additional channel whether it be SMS or telephone call-back can
improve the chances authentication, this is still not even close to the
type of authentication one can get in person.
Further discussion however, will show that physical presence is often
over-rated because the people who do the identification and grant
authorization can also be easily fooled. Risk of getting caught is not
much higher for those people but the speed to repercussion is. Over the
net, there is much less repercussion if denied: the difference between
"Access Denied" on-line and "Hey, wait a minute while I get my manager"
(as guard approaches).
I've been doing a lot of researching into Trusted Computing for the
OpenTC project and it's clear that TC may not have the answer either,
but it's not as bad. At least it closes the link between person and
computer a bit better for the sake of identification.
I am interested in hearing from others though on replacement or
enhancement security for authentication where identification and
authorization are not weak links or the speed or level of repercussion
is up there with the physical world.
-pete.
-------------------------------------------------------------------------
Sponsored by: Watchfire
As web applications become increasingly complex, tremendous amounts of
sensitive data - personal, medical and financial - are exchanged, and
stored. Consumers expect and demand security for this information. This
whitepaper examines a few vulnerability detection methods - specifically
comparing and contrasting manual penetration testing with automated
scanning tools. Download "Automated Scanning or Manual Penetration
Testing?" today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm
--------------------------------------------------------------------------
--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.394 / Virus Database: 268.9.8/380 - Release Date: 30/06/2006
--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.394 / Virus Database: 268.9.8/380 - Release Date: 30/06/2006
-------------------------------------------------------------------------
Sponsored by: Watchfire
As web applications become increasingly complex, tremendous amounts of
sensitive data - personal, medical and financial - are exchanged, and
stored. Consumers expect and demand security for this information. This
whitepaper examines a few vulnerability detection methods - specifically
comparing and contrasting manual penetration testing with automated
scanning tools. Download "Automated Scanning or Manual Penetration
Testing?" today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm
--------------------------------------------------------------------------
