6115713
story
Comments: 336 +- IT: Schneier On Un-Authentication on Monday September 28, @10:51AM
background: url(//a.fsdn.com/sd/topics/topicsecurity.gif); width:59px; height:78px;
security
background: url(//a.fsdn.com/sd/topics/topicit.gif); width:75px; height:61px;
it
Trailrunner7 writes "Bruce Schenier writes on Threatpost.com: 'In computer security, a lot of effort is spent on the authentication problem. Whether it is passwords, secure tokens, secret questions, image mnemonics, or something else, engineers are continually coming up with more complicated — and hopefully more secure — ways for you to prove you are who you say you are over the Internet. This is important stuff, as anyone with an online bank account or remote corporate network knows. But a lot less thought and work have gone into the other end of the problem: how do you tell the system on the other end of the line that you are no longer there? How do you un-authenticate yourself? My home computer requires me to log out or turn my computer off when I want to un-authenticate. This works for me because I know enough to do it, but lots of people just leave their computer on and running when they walk away. As a result, many office computers are left logged in when people go to lunch, or when they go home for the night. This, obviously, is a security vulnerability.'"
Related Stories
: by
A great many people think they are thinking when they are merely
rearranging their prejudices.
-- William James
All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.
Effective way to keep screens locked (Score:5, Funny)
A bank I did some consulting work for had a very effective cultural rule to force people to lock their machines when they left their desks: if you find an unlocked machine, pull up the email client and send a message to everyone: "today's my birthday, drinks on me after work!" (other NSFW messages left to the readers imagination.)
Apparently, very few people left their machines unlocked more than once...
Re: (Score:3, Interesting)
The bank in one of our local grocery stores has frighteningly lax security...
There's a computer running Windows XP there, against the back wall, with the screen in plain view of anyone walking by. It is pretty much always on and always logged in, sitting at the Windows XP desktop. Usually with a couple programs minimized in the taskbar. It's also got a desktop wallpaper set with BGINFO, so it's displaying the computer name and IP address and whatever else.
The grocery store itself stays open long after th
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
I worked at an office where we used Baggy pantsing [jargondb.org] to achieve this same effect. It worked brilliantly until on particular manager tried to make it seem like we were causing the problem, not pointing it out. I don't think that person lasted too long though.
Re:Effective way to keep screens locked (Score:5, Insightful)
So, you are a thief?
Parent
Re:Effective way to keep screens locked (Score:4, Insightful)
No, moron, you are basically having a charge appear on someone else's account for services you got.
And the services are not purely electronic. You got a service that really cost someone else money.
And on top of that, you assume I download music/other files illegally. I don't.
So, not only are you a thief, but you are not very bright. And you jump to conclusions that are not supported by the facts.
Parent
Re:Effective way to keep screens locked (Score:5, Insightful)
Hi Commodore,
You again make assumptions about my behavior. I can quite honestly tell you I have not done any of the above except ad blocking, which is neither illegal nor amoral.
You again fail to see the very obvious. You charged your services to someone else's account. This isn't complicated.
As far as my "sinning", yes I have done things I wish I hadn't. However, you come here bragging about what you have done, and then continue to justify your actions using absolutely moronic logic. if you want to follow your "sin" analogy, then you have not "repented". While you are unrepentant, you are to be treated as though you an outside, shunned and ignored.
The bottom line is that you stole from the people you did this to.
Parent
Re: (Score:3, Insightful)
I disagree. Google is a search engine and doesn't always know which is the best answer (or even the right one).
A Merrian-Webster dictionary or OED is considered a primary source for standard word definition (or existence). In the academic and engineering world we care about where the 'facts' come from. So sources do matter.
If you know where to look in a trusted and accurate source, you should always go there before a search engine. Yesterday, I needed to know the syntax for srncpy. So I typed man strnc
Re: (Score:3, Funny)
I was 17 and stupid
Well, at least you aren't 17 anymore. 1 out of 2 isn't bad.
Re: (Score:3, Insightful)
Re:Effective way to keep screens locked (Score:5, Insightful)
How is using physical paper and toner paid for by someone else with their money the same as downloading a digital version of a movie that you already have the VHS for, but it got chewed up when your VCR died?
There's a very good reason why the laws of virtually every country in the world DO NOT consider downloading data to be theft.
Because it's not.
It's copyright infringement.
I'm not saying it's right, or justified, or anything to do with the moral right or wrong of it. If you come out with a comment about how I'm a scofflaw just because I don't think it's stealing, you've just shown your own immaturity, and complete lack of awareness of the situation, as well as sheer arrogance in putting words in my mouth.
The simple legal fact is, the two are not connected in any way, regardless of entertainment industry propaganda.
Parent
Re: (Score:3, Insightful)
No. What I did was no more stealing than when you (and lots of other people) download movies, songs, or tv shows. It's not real property - it's just internet data.
Think about it. If I'm right - it's not stealing. If you're right, then it is stealing and so too is downloading/bittorenting and you too are a thief. (ponder) Ooops.
When I download a song (which I will readily admit to doing) I use my own disk space and bandwidth, which I paid for, to make duplicates of bits stored on another server. While I may very well be failing to pay for the song (actually, I usually do pay for it) I am not actually taking anything away from anyone. The act of making my own copy of those bits does not remove those bits from the original owner's possession. That's why it's called copyright infringement and not theft.
You, on the other hand, made
Re:Effective way to keep screens locked (Score:5, Funny)
Of course, the fun rose exponentially when two people had their machines unlocked. I would frequently carry on a whole phantom conversation.
"Hey, let's go to lunch tomorrow"
"I can't, I have to wax my hamster"
"I didn't know you had a hamster"
"..."
Parent
In the Marine Corps... (Score:4, Funny)
Any time someone left a machine unlocked in the MC we would pounce on it. It would take less than 2 minutes to get emails out to the appropriate members of the chain of command to volunteer the Marine for every shit duty we could find (and swap his or her desktop background screen saver to something highly entertaining or inappropriate).
-Rick
Parent
Re: (Score:3, Insightful)
All that means is I have to watch for you leaving and get there before the screen saver kicks in.
Re:Effective way to keep screens locked (Score:5, Interesting)
You can get little RFID tokens that you keep in your pocket. When you move out of range of the RFID reader on the PC (about 3m away) it automatically locks the workstation and can either require a password to unlock or simply having the token back in range.
Parent
Re: (Score:3, Interesting)
I just hit Windows-L on the keyboard as I'm getting up.
In fact, if I'm not using the computer, it's usually locked – even if I'm at my desk doing paperwork.
Re: (Score:3, Interesting)
Another idea - bluetooth. Virtually all cell phones and a lot of laptops have it. A small BT adapter should cost about a few bucks. libpam-blue is already there.
Re:Effective way to keep screens locked (Score:4, Funny)
Parent
Re: (Score:3, Informative)
This is brilliant!
Or it would be if I, as the sysadmin, couldn't easily send email in anyone's name...
Wow. Don't you feel important? Except that, really, ANYONE can send an email as ANYONE else, at ANY TIME. Here's a tip: type the following in a telnet prompt, where your ISP's mail server is called "smtp.myisp.com"
# telnet smtp.myisp.com 25
HELO foobar
MAIL FROM: billgates@microsoft.com
RCPT TO: samjones109@yahoo.com
SUBJECT: Free drinks on the house!
Hey! I gots my billions of dollars so come down to Joe's bar at 5:30 and drinks are on me!
-Billie Richboy. .
Congratulations! You've just faked being Bill Gates to Sam Jones! Wasn't that hard?
A few times, I've gotten a cheap kick sending text messages via the SMS gateway to cell phone users from themselv
I lock my computer when I walk away (Score:3, Informative)
Re:I lock my computer when I walk away (Score:5, Informative)
I'll save you a keystroke, windows-L works too.
Parent
Re: (Score:3, Insightful)
Why? They work great as the "meta" key in Linux, at least for the US keyboard layout I end up getting.
Re: (Score:3, Insightful)
Yeah, that'll teach the establishment a lesson, you little rebel!
Fuck the system, man!
Oh, and I nearly forgot: "Arise, chicken! Chicken, arise!"
(for the uninitiated: ATHF [wikipedia.org])
Re: (Score:3, Informative)
If no activity for X minutes, lock the PC and send an email reminder to the user that says "Hey Dumbass, lock your PC when you leave".
Yeah, because I never sit at my desk for ten minutes on a phone call or reviewing paper notes.
Re: (Score:3, Insightful)
I am more referring to the email part, not the lock part. Locking is fine. The automated email doesn't.
And for god's sake, this is not AOL. Please don't type like you are.
Re:I lock my computer when I walk away (Score:5, Funny)
Then make the lock at 11 minutes or u can give your mouse a click while u re talking.Doesnt sound that hard.U just have to adopt.
But... I don't want any more children.
Parent
Re: (Score:3, Insightful)
Hardcopy Playboy. It gets around the web monitoring software.
Re: (Score:3, Interesting)
Unless your password is in the hundreds of thousands of characters, I highly doubt that it is 'un-rememberable'. Just take your normal password, make the p455w0rd 1337, then make one of the letters in the p455W0rd capitalized. There, you have a secure password that only requires that you remember which letter you capitalized.
A secure password?? That would be easy enough if I only needed "a" password, not fifty. (and one of the rules I do follow-- apparently the only person in the universe who does-- is to never use the same password on two different systems). And if I didn't have to change it every month.
Except that even then your system fails, since it has to have upper and lower case and numbers and symbols, and has to start and end with a letter, and one of the first eight characters has to be a number, and a couple of
Re: (Score:3, Interesting)
A secure password?? That would be easy enough if I only needed "a" password, not fifty. (and one of the rules I do follow-- apparently the only person in the universe who does-- is to never use the same password on two different systems). And if I didn't have to change it every month.
Well, if you are able to set your own passwords you can still use a similar setup to what pwffff was suggesting.
Say you have 50 passwords, each needs to be diff, and they change every so often. Make all your passwords start with p455W0rd, then the next 2 (or more if you are so inclined) characters you could use to signify which server / app / product it is to be used with, and then have the next 2 characters increment for each time you are mandated to change your password.
i.e.[base password][few chara
Re: (Score:3, Informative)
Windows doesn't support it in a multi-user network environment. I don't know why, but it doesn't.
User education. (Score:2)
User education. It won't go away, you always need to do it, and for most users, you have to do it multiple times. Proximity systems may help, but...
For the record, on a winders machine, window-L. Two keystrokes, you're done. Well, mostly, but that'll keep most people out.
Article states the obvious (Score:3, Insightful)
Designing systems for usability is hard, especially when security is involved.
Meh.. I was hoping for some deeper insights than that.
Solutions that work, but are too bulky. (Score:5, Informative)
Back before ease of use eclipsed security, I once encountered a military system where the access terminal was surrounded by a small fence. Opening the gate in the fence forced an immediate logout.
Nobody would tolerate that today. Except, maybe, for an ATM.
Re:Solutions that work, but are too bulky. (Score:4, Insightful)
Parent
Reauthenticate when suspicious (Score:4, Interesting)
If you really do need to do this kind of thing (I suppose people sometimes do have legitimate requirements to wire large amounts of money to offshore accounts), it's not a big hassle to log in again.
MS solved this problem, but removed it with W2K+ (Score:5, Funny)
Windows 95/98/ME had a built-in solution to this problem, but MS removed it in the Win 2K and newer. They simply had the machine crash every 2 hours. Heavy handed, sure, but it worked.
It still works in XP (Score:3, Funny)
At least it does on my compu[BSOD graphic goes here]
Re:It still works in XP (Score:4, Funny)
Parent
This is more a policy issues then a technical one (Score:3, Insightful)
While yes, there are technical measures that you can put in place to automatically lock screens and accounts and such after a pre determined time period, the best solution is a policy, and actual enforcement of that policy. There in lies the problems in many organizations, enforcement is not being done consistently.
With technical controls, there is always that time frame, for example idle accounts, usually 30 days from last login and then automatically lock the account, well a malicious user has 30 days to which to attempt access to that account. Same goes for screen locks, 15 min is a common default, well you walk away and I have 15 min to make my way over and have fun with the account. You can reduce the amount of time, but that has other issues, users get annoyed at the screen locking while they are on the phone, or whatever while they are at their desk, results in crappy passwords.
With a policy, and enforcement behind it, accounts can be removed, users will lock their screens (hopefully) within a timely manner.
Put the onus on the client (Score:3, Informative)
You make the client system re-authenticate after a configurable amount of time, and that authentication comes via central storage of authentication passwords/tokens. For example, Keychain.
My laptop is set up with SSHKeychain, and it has options for locking my Keychain. If I activate the screensaver and don't come back within 3 minutes or so, it locks the keychain, and any program that wants to use a stored password triggers a password authenticaton dialog box for the system keychain password.
This puts the power of security in the hands of the user or organization. Computer at home, no roommates? Probably not an issue to lock your keychain any time except when you shut down your computer. Work in a cube? After 5-10 minutes of inactivity or whenever you lock your screensaver.
Location based devices.. (Score:3, Informative)
Some places use smartcards, the card must be in the slot or it locks your screen... The same card is also used to open the doors so if you leave the room without taking the card then you can't get back in. Most people had the card attached to their belt or similar.
Another idea is to track the location of your phone using bluetooth (10 meters range), if you walk too far away it loses signal and locks the screen.
This is De-Authorizing, not De-Authenticating (Score:4, Interesting)
Re:How do you un-authenticate? (Score:5, Insightful)
Think of a remote connection to Remote Desktop for Windows. When does the server know when to sever the connection? Is it after some time delay of minimal activity? If it's left authenticated for time X, and the ability for the traffic to be hijacked is Y, are X and Y proportional?
It's not as simple as I walk away from a physical machine anymore. My favorite is when an application doesn't close when you press the X in windows (upper right) or OS X (upper left). It's connections are still left open, leaving authentication on opening the application worthless.
Parent
Re: (Score:3, Insightful)
On a Mac, that closes the window, but the application is still running.
Re: (Score:3, Interesting)
Kbluelock.
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Then the screaming started. Folks would walk away from their computers and come back to a locked screen... But they wouldn't know how to log in. They didn't know what username and password to put in there because it looked ever so slightly different from what they saw when they first showed up in the morning.
You have to have the cooperation of the people at the top of the organization, who would send a memo to everyone saying that for security reaons, this is what you WILL do, and failure will result in dis
Re: (Score:3, Interesting)
I have no idea how to do it in bash, but you can easily lock a computer from the command line in Windows.
rundll32.exe user32.dll,LockWorkStation
Another one:
rundll32.exe shell32.dll,SHExitWindowsEx [0|1|2|4|8]
0: logoff, 1: shut down, 2: reboot, 4: forced shutdown, 8: powers down the machine
This would be a fun one to put in the Startup menu of someone who left their PC unlocked, actually... :D
Re: (Score:3, Informative)