Slashdot Log In
MS to Trade Passwords for 2-Factor Authentication
Posted by
timothy
on Wed Mar 16, 2005 02:43 PM
from the something-borrowed-something-blue dept.
from the something-borrowed-something-blue dept.
Bret Tobey writes "During a security panel at CEBIT, Microsoft's Senior Director for Trustworthy Computing commented that Longhorn would abandon passwords in favor of two factor authentication. While it's hard to argue for keeping passwords, it does raise questions about where this could all lead. None other than Bruce Schneier pointed out how two factor authentication can fail us."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
MS version (Score:5, Funny)
Two Factor Authentication, MS style (with apologies to Monty Python).
"What... is your name..."
"What... is your favourite colour?"
Re:MS version (Score:5, Funny)
Parent
They're already doing this! (Score:5, Funny)
"What...is your login..."
"What...is your password?"
Parent
It has its uses... (Score:5, Insightful)
I suspect that this is just MS responding to their corporate customers' requests.
Re:It has its uses... (Score:5, Funny)
Now speak the following phrase clearly into the microphone:
"When tweedle beetles battle, it's called a tweedle beetle battle
and when they battle in a puddle, it's called a tweedle beetle puddle battle
AND
when beetles battle beetles with paddles in a puddle, THIS is what they call...
a tweedle beetle puddle paddle battle
AND
when the beetle puddle paddle battle is a battle in a bottle THIS is what they call...
a tweedle beetle bottle battle puddle paddle muddle!"
Voiceprint recorded. Please repeat for verification...
Parent
Logging in (Score:5, Funny)
Re:Logging in (Score:5, Funny)
Parent
What Is Two Factor Authentication? (Score:5, Informative)
Something you have: This factor includes keys, cards, tokens and so on. These things can also be stolen or lost. Something you have can also be known as "something you are," and includes physical or physiological characteristics such as a fingerprint or vocal patterns.
Something you know: Passwords and PINs are examples of this factor. It is important to note that this knowledge can be lost, shared or guessed by others.
Source [itsecurity.com].
They're making this problem seem too hard (Score:5, Funny)
Name:__________
Email address:_________
Birthdate:__________
Last four digits of SSN:________
Mother's maiden name:___________
[OK] [Cancel]
Instant, foolproof security with no hardware to deal with or passwords to remember.
Re:They're making this problem seem too hard (Score:5, Funny)
But yet you still can't seem to crack the secret code known as humor.
Parent
The point is not that TFA can fail... (Score:5, Informative)
Right now, any idiot with an "HTML for Dummies" book can set up a site that looks like a banks', and just about anyone knows how to send an email.
With two factor authentication, the techniques that Schneier talks about (MITM, and Trojan) are more difficult to implement, making the crime more difficult, and "weeding out" those criminals who are less likely to pursue the crime in the face of more difficult technology and/or an increase in learning and/or time.
Unrelated to Schneier's concerns (Score:5, Interesting)
But logging into your local computer or the LAN is different, and 2 factor authentication could be helpful. It wouldn't necessarily be helpful against trojan attacks; once an authenticated user infects their own system the attack can continue to run with the credentials of the user. But it should defeat some network attacks and enhance security of systems that are physically compromised.
MS ActiveButtPlug Technology... (Score:5, Funny)
What two factor means for the home user (Score:5, Insightful)
1) Something you can loose
2) Something you can forget
I thought it was already pretty adventerous of OS X to make users log in all the time, to also provide a user something they can loose... that seems like it will have issues.
It does seem like it should make resale of Windows easier to justify, as long as you are selling a security token of some sort with it.
Only Useful in Corporate Environments (Score:5, Insightful)
I believe that current hardware tokens are all based on private key encryption algorithms. The key is stored in the device, as well as in the backend authentication server. This works fine within a single administrative domain, but is pretty much useless in cross domain situations.
How can I use my hardware token from work to authenticate to my bank? There are only two ways I know of. Either my bank and my employer both know the secret key for my fob, in which case either one can spoof me to the other one. Or my bank has my employer perform the authentication. Neither one of which is desirable. I suppose someone could start selling hardware tokens where the users can program multiple keys into it, and the user would then have to choose the proper key when logging in, but I've never seen one. Which still leaves the problem of how my bank and I communicate the secret key securely.
Ideally I think these hardware tokens would be public-key based. But as far as I know, there isn't any way to do a public-key authentication using a reasonable number of bits. As in, a type-able number of bits. No body is going to type in the 128 hex characters which result from a 1024-bit RSA key signature for example. Is there any way to get around this? Maybe, but I don't know of it. The other option is to use a USB interface (or something) so the user doesn't have to type the response.
Two way authentication works today (Score:5, Informative)
After you've set up a couple of transactions you'll need to authorise again (with pin) for the bank to get them processed. This time with 2-factor authentication.
This way, a man in the middle attack as Schneier describes is a little less likely since one knows exactly when one is authorising a transaction or merely logging in.
Re:A question worth asking (Score:5, Informative)
Something you have (a key, a smartcard)
Something you know (a password, a PIN)
Something you are (a fingerprint, a voiceprint)
It's much more secure to use two of those than it is to use just one. Each one has a failing, security wise, and it's different than the failings of the others. So if you use two, you make it much less likely that someone will be able to compramise your security.
Parent
Re:A question worth asking (Score:5, Funny)
gawd... i can jsut see it now, longhorn is also "for home users"
T: thank you for calling mircosoft
C: yesM i just got back from them there hospital, i done lost my finger in me JhonDeer 600GT riding lawnwoer
T: uhh.. yessss... and..
C: well they couldnt re-attach it ya see
T: riiiighhttt...
C: well sonny how can i log on to my internet box and email my friends to let them know what ive gone and done if i cant log on with this here finger scanner
Parent
Microsoft's Response (Score:5, Funny)
MS Tech Support: Well, I'm afraid Sir that since your copy of Windows had it's product activation linked to that one finger, you're no longer legally licensed to use it. If you'd like, I can make a direct withdrawal from your checking account to purchase a new copy of Windows, complete with Internet Explorer 7.01 that you can activate with any of your remaining digits, or, some other body part that you'd be less likely to be careless with.
Parent
Re:A question worth asking (Score:5, Insightful)
Something you have (a key, a smartcard)
Something you know (a password, a PIN)
Something you are (a fingerprint, a voiceprint)
It's much more secure to use two of those than it is to use just one. Each one has a failing, security wise, and it's different than the failings of the others. So if you use two, you make it much less likely that someone will be able to compramise your security.
On a side note, although the idea of biometrics and keycards sounds cooler than a password, there's a reason why computer security has been using the "something you know" for so long. Of the three, it's generally hardest to steal, hardest to fake, and easiest to change (in case someone else does gain access).
I'm not arguing that using 2 (or 3) factors won't be generally more secure than using 1, but people do tend to be quick to jump on the bandwagon of shiney new things, and the fact is that a good password is a good start to a good security setup.
Parent
Re:A question worth asking (Score:5, Funny)
Hopefully that helps...
Parent
Re:A question worth asking (Score:5, Insightful)
Parent
Re:Bruce Schneier. The anti solution. (Score:5, Insightful)
Most of the commentary I've read from him sounds pretty sane. He makes a point of pointing out misdirected security efforts that fail to secure real issues. Recognizing a mistake is a step toward finding a solution.
I can't complain about that; security is actually *really tough* to pull off.
Parent
Re:Reporting leaves something to be desired (Score:5, Funny)
"Please enter your login"
"Thank you, please enter your password"
"So far so good. Now, reading over the last few emails you've replied to, it appears you have some trouble 'getting it up'. As a final verification, please confirm the date of your most recent order of Viagra"
Kinda like AdSense, but much more intrusive...
Parent
Re:Two Factor Authentication. (Score:5, Funny)
Hurray for increasing IT costs! Good job MS, you always come through in that dept.
Parent