Schneier On Un-Authentication 336
Trailrunner7 writes "Bruce Schenier writes on Threatpost.com: 'In computer security, a lot of effort is spent on the authentication problem. Whether it is passwords, secure tokens, secret questions, image mnemonics, or something else, engineers are continually coming up with more complicated — and hopefully more secure — ways for you to prove you are who you say you are over the Internet. This is important stuff, as anyone with an online bank account or remote corporate network knows. But a lot less thought and work have gone into the other end of the problem: how do you tell the system on the other end of the line that you are no longer there? How do you un-authenticate yourself? My home computer requires me to log out or turn my computer off when I want to un-authenticate. This works for me because I know enough to do it, but lots of people just leave their computer on and running when they walk away. As a result, many office computers are left logged in when people go to lunch, or when they go home for the night. This, obviously, is a security vulnerability.'"
Effective way to keep screens locked (Score:5, Funny)
A bank I did some consulting work for had a very effective cultural rule to force people to lock their machines when they left their desks: if you find an unlocked machine, pull up the email client and send a message to everyone: "today's my birthday, drinks on me after work!" (other NSFW messages left to the readers imagination.)
Apparently, very few people left their machines unlocked more than once...
Re: (Score:2, Insightful)
This is brilliant!
Or it would be if I, as the sysadmin, couldn't easily send email in anyone's name...
Re: (Score:2)
Who says you need to be the sysadmin? Since email is insecure and most people can't read headers anyways, anyone could do that from their own system.
Re: (Score:3, Informative)
This is brilliant!
Or it would be if I, as the sysadmin, couldn't easily send email in anyone's name...
Wow. Don't you feel important? Except that, really, ANYONE can send an email as ANYONE else, at ANY TIME. Here's a tip: type the following in a telnet prompt, where your ISP's mail server is called "smtp.myisp.com"
# telnet smtp.myisp.com 25
HELO foobar
MAIL FROM: billgates@microsoft.com
RCPT TO: samjones109@yahoo.com
SUBJECT: Free drinks on the house!
Hey! I gots my billions of dollars so come down to Joe's bar at 5:30 and drinks are on me!
-Billie Richboy. .
Congratulations! You've just faked being Bill Gates to Sam Jones! Wasn't that hard?
A few times, I've gotten a cheap kick sending text messages via the SMS gateway to cell phone users from themselv
Re: (Score:2, Insightful)
Re: (Score:3, Interesting)
The bank in one of our local grocery stores has frighteningly lax security...
There's a computer running Windows XP there, against the back wall, with the screen in plain view of anyone walking by. It is pretty much always on and always logged in, sitting at the Windows XP desktop. Usually with a couple programs minimized in the taskbar. It's also got a desktop wallpaper set with BGINFO, so it's displaying the computer name and IP address and whatever else.
The grocery store itself stays open long after th
Re: (Score:2)
I did that, but I usually IM'd the boss with something wacky... like "Man, I'm soooo drunk right now. :-)"
Re:Effective way to keep screens locked (Score:5, Funny)
Of course, the fun rose exponentially when two people had their machines unlocked. I would frequently carry on a whole phantom conversation.
"Hey, let's go to lunch tomorrow"
"I can't, I have to wax my hamster"
"I didn't know you had a hamster"
"..."
In the Marine Corps... (Score:4, Funny)
Any time someone left a machine unlocked in the MC we would pounce on it. It would take less than 2 minutes to get emails out to the appropriate members of the chain of command to volunteer the Marine for every shit duty we could find (and swap his or her desktop background screen saver to something highly entertaining or inappropriate).
-Rick
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
I worked at an office where we used Baggy pantsing [jargondb.org] to achieve this same effect. It worked brilliantly until on particular manager tried to make it seem like we were causing the problem, not pointing it out. I don't think that person lasted too long though.
Re:Effective way to keep screens locked (Score:5, Insightful)
So, you are a thief?
Re:Effective way to keep screens locked (Score:4, Insightful)
No, moron, you are basically having a charge appear on someone else's account for services you got.
And the services are not purely electronic. You got a service that really cost someone else money.
And on top of that, you assume I download music/other files illegally. I don't.
So, not only are you a thief, but you are not very bright. And you jump to conclusions that are not supported by the facts.
Re:Effective way to keep screens locked (Score:5, Insightful)
Hi Commodore,
You again make assumptions about my behavior. I can quite honestly tell you I have not done any of the above except ad blocking, which is neither illegal nor amoral.
You again fail to see the very obvious. You charged your services to someone else's account. This isn't complicated.
As far as my "sinning", yes I have done things I wish I hadn't. However, you come here bragging about what you have done, and then continue to justify your actions using absolutely moronic logic. if you want to follow your "sin" analogy, then you have not "repented". While you are unrepentant, you are to be treated as though you an outside, shunned and ignored.
The bottom line is that you stole from the people you did this to.
Re: (Score:2)
Actually ad-blocking is amoral, but not immoral. Try a dictionary. Hell, use google if you have to.
Dictionary (Score:2)
Using google to learn something is superior to using a dictionary. It should be your first choice. Only if google does not supply an acceptable answer (or if the answer you get proves you to be a fool who believes everything he reads online) should you consult dead trees.
Re: (Score:3, Insightful)
I disagree. Google is a search engine and doesn't always know which is the best answer (or even the right one).
A Merrian-Webster dictionary or OED is considered a primary source for standard word definition (or existence). In the academic and engineering world we care about where the 'facts' come from. So sources do matter.
If you know where to look in a trusted and accurate source, you should always go there before a search engine. Yesterday, I needed to know the syntax for srncpy. So I typed man strnc
Re: (Score:3, Funny)
I was 17 and stupid
Well, at least you aren't 17 anymore. 1 out of 2 isn't bad.
Re: (Score:2, Informative)
You used someone else's credentials so that you could obtain a physical object for free, and you caused actual monetary damages for an innocent victim. This is not comparable to a nebulous "it's not real stealing" case like downloading music or movies. You committed either theft, fraud, or both, in a very real-world sense.
Re: (Score:3, Insightful)
Re:Effective way to keep screens locked (Score:5, Insightful)
How is using physical paper and toner paid for by someone else with their money the same as downloading a digital version of a movie that you already have the VHS for, but it got chewed up when your VCR died?
There's a very good reason why the laws of virtually every country in the world DO NOT consider downloading data to be theft.
Because it's not.
It's copyright infringement.
I'm not saying it's right, or justified, or anything to do with the moral right or wrong of it. If you come out with a comment about how I'm a scofflaw just because I don't think it's stealing, you've just shown your own immaturity, and complete lack of awareness of the situation, as well as sheer arrogance in putting words in my mouth.
The simple legal fact is, the two are not connected in any way, regardless of entertainment industry propaganda.
Re: (Score:2)
And that several reams of paper and new toner that someone had to physically replace? Your analogy would be correct if you received 1000 PDFs, but you received a physical product that costs real money to produce.
On top of that, if the club reimbursed you for the printing costs then that's fraud as well. Or were they complicit in this scheme to rip others students off?
Re: (Score:2)
No the club operated just like ACORN or SEIU - volunteers don't get reimbursed. You do it on your own. I quit the club after only three months because they demanded a lot from their volunteers, which I couldn't afford to give.
Re: (Score:3, Insightful)
No. What I did was no more stealing than when you (and lots of other people) download movies, songs, or tv shows. It's not real property - it's just internet data.
Think about it. If I'm right - it's not stealing. If you're right, then it is stealing and so too is downloading/bittorenting and you too are a thief. (ponder) Ooops.
When I download a song (which I will readily admit to doing) I use my own disk space and bandwidth, which I paid for, to make duplicates of bits stored on another server. While I may very well be failing to pay for the song (actually, I usually do pay for it) I am not actually taking anything away from anyone. The act of making my own copy of those bits does not remove those bits from the original owner's possession. That's why it's called copyright infringement and not theft.
You, on the other hand, made
Re: (Score:2)
So it was YOU!
I'll be subpoenaing slashdot for your information.
Re: (Score:2)
Yeah well I was young and stupid, and didn't really think about the consequences of what I was doing. Also underage. http://nelsonhaha.com/ [nelsonhaha.com]
Re: (Score:2)
Wow, your college charged for print offs from the computer room?
I guess
Re: (Score:3, Insightful)
All that means is I have to watch for you leaving and get there before the screen saver kicks in.
Re:Effective way to keep screens locked (Score:5, Interesting)
You can get little RFID tokens that you keep in your pocket. When you move out of range of the RFID reader on the PC (about 3m away) it automatically locks the workstation and can either require a password to unlock or simply having the token back in range.
Re: (Score:3, Interesting)
I just hit Windows-L on the keyboard as I'm getting up.
In fact, if I'm not using the computer, it's usually locked – even if I'm at my desk doing paperwork.
Re: (Score:3, Interesting)
Another idea - bluetooth. Virtually all cell phones and a lot of laptops have it. A small BT adapter should cost about a few bucks. libpam-blue is already there.
Re:Effective way to keep screens locked (Score:4, Funny)
I lock my computer when I walk away (Score:3, Informative)
Re:I lock my computer when I walk away (Score:5, Informative)
I'll save you a keystroke, windows-L works too.
Re: (Score:2)
or apparently Windows-P on my keyboard...oh I'm using Dvorak.
Re: (Score:3, Insightful)
Why? They work great as the "meta" key in Linux, at least for the US keyboard layout I end up getting.
Re: (Score:3, Insightful)
Yeah, that'll teach the establishment a lesson, you little rebel!
Fuck the system, man!
Oh, and I nearly forgot: "Arise, chicken! Chicken, arise!"
(for the uninitiated: ATHF [wikipedia.org])
Re: (Score:2)
ctl + alt + del -> k on windows
For XP and newer there's an even easier way...
WinKey + L
Instantly locks your computer.
Re: (Score:2)
Other than Win-L, you can save yourself a hunt for the 'K' key and realize that "Lock Computer" is the first button in the "security dialog" that pops up. Ctrl-Alt-Del-Enter works far faster since Enter on the numpad works and is a convenient location to hit it whilst standing up.
Doesn't work for everyone (especially those where group policy disables lock) - but hitting enter to "Log Off" doesn't do anything disaterous until you hit it again (it pops up a dialog asking for
Re: (Score:2)
Okay, I realize you can disable locking via GP, but why would you? Most IT staffs fight with their users to lock their machines, or try to negotiate a reasonable timeout (I keep my own workstation at a timeout of one minute, with a lock-grace period of 15 seconds (so if it accidentally comes on while reading something, I can just bump the mouse without needing to reenter my password).
Not like the admins can't get into your ma
Re: (Score:2)
The only reaction I can put into words is, "They're doing it wrong!"
If you're on my network I can see your stuff and the only person who knows your password had better be you.
Re: (Score:2)
Admins can always log users out; but having a few putzes lock their machines and wander away can substantially reduce the throughput of a public drop-in lab. For schools and the like, this is the primary motivation.
Now, a better solution would be to allow any user to log out a locked user, or have locked accounts automatically become eligible for one-click logout after x minutes, or a combination of the
Re: (Score:3, Informative)
Windows doesn't support it in a multi-user network environment. I don't know why, but it doesn't.
Re: (Score:2)
Other than Win-L, you can save yourself a hunt for the 'K' key and realize that "Lock Computer" is the first button in the "security dialog" that pops up.
Errm....
How crappy a typist do you have to be to have to "hunt" for the K key? It's not like it moves around on a frequent basis.....
Re: (Score:2)
Indeed. And the company I work for has an effective way of ensuring employees complete the above steps, too: if you don't, you get fired. Or a formal disciplinary, at any rate.
You'd be amazed how effective a method that is for ensuring "un-authentication". There's a 5 minute screensaver for good measure, and most network services on the intranet have a very short time-out.
What more do you need?
Re: (Score:3, Informative)
If no activity for X minutes, lock the PC and send an email reminder to the user that says "Hey Dumbass, lock your PC when you leave".
Yeah, because I never sit at my desk for ten minutes on a phone call or reviewing paper notes.
Re: (Score:2)
Re: (Score:2)
I believe similar technology is used in some high security installations. I believe it was someone from Diebold (new company name escapes me) that talked about this.
Re: (Score:2)
I do that all the time... with my PC locked.
Re: (Score:3, Insightful)
I am more referring to the email part, not the lock part. Locking is fine. The automated email doesn't.
And for god's sake, this is not AOL. Please don't type like you are.
Re:I lock my computer when I walk away (Score:5, Funny)
Then make the lock at 11 minutes or u can give your mouse a click while u re talking.Doesnt sound that hard.U just have to adopt.
But... I don't want any more children.
Re: (Score:3, Insightful)
Hardcopy Playboy. It gets around the web monitoring software.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
One job (at a large mega-corporation) required everyone to take an online security class once a year. You had to pass a test to get credit for the class. On one test, it gave the following, "True or False: The best way to remember your password is to keep it on a sticky note on your monitor."
The answer they wanted was obviously False, but I so wanted to put True. What possible way could be better? People can try to remember but when you have dozens of accounts, passwords will inevitably be forgotten. I
Re: (Score:3, Interesting)
Unless your password is in the hundreds of thousands of characters, I highly doubt that it is 'un-rememberable'. Just take your normal password, make the p455w0rd 1337, then make one of the letters in the p455W0rd capitalized. There, you have a secure password that only requires that you remember which letter you capitalized.
A secure password?? That would be easy enough if I only needed "a" password, not fifty. (and one of the rules I do follow-- apparently the only person in the universe who does-- is to never use the same password on two different systems). And if I didn't have to change it every month.
Except that even then your system fails, since it has to have upper and lower case and numbers and symbols, and has to start and end with a letter, and one of the first eight characters has to be a number, and a couple of
Re: (Score:3, Interesting)
A secure password?? That would be easy enough if I only needed "a" password, not fifty. (and one of the rules I do follow-- apparently the only person in the universe who does-- is to never use the same password on two different systems). And if I didn't have to change it every month.
Well, if you are able to set your own passwords you can still use a similar setup to what pwffff was suggesting.
Say you have 50 passwords, each needs to be diff, and they change every so often. Make all your passwords start with p455W0rd, then the next 2 (or more if you are so inclined) characters you could use to signify which server / app / product it is to be used with, and then have the next 2 characters increment for each time you are mandated to change your password.
i.e.[base password][few chara
User education. (Score:2)
User education. It won't go away, you always need to do it, and for most users, you have to do it multiple times. Proximity systems may help, but...
For the record, on a winders machine, window-L. Two keystrokes, you're done. Well, mostly, but that'll keep most people out.
Incentives, too. (Score:2)
Catch a coworker with their screen unlocked, get a small bonus.
Get caught that way more than x number of times, get fired. The pink slip is the most effective LART, when it's feasible to use it.
Oh, and make it easy. On KDE, ctrl+alt+l locks my screen. Logging out isn't much harder (win+backspace, then alt+l), but it's not significantly more secure, and it is less convenient (I have to close everything, and I have to watch the logout process to make sure it completes -- lock screen is instantaneous).
Bad company policies then (Score:2)
This works for me because I know enough to do it, but lots of people just leave their computer on and running when they walk away. As a result, many office computers are left logged in when people go to lunch, or when they go home for the night. This, obviously, is a security vulnerability.
Sounds like lazy IT PHBs. At my company you're required to have a password-protected screen saver that kicks in after fifteen minutes, with policies set up so that you're automatically logged off an hour after your quitti
Re: (Score:2)
This works for me because I know enough to do it, but lots of people just leave their computer on and running when they walk away. As a result, many office computers are left logged in when people go to lunch, or when they go home for the night. This, obviously, is a security vulnerability.
Sounds like lazy IT PHBs. At my company you're required to have a password-protected screen saver that kicks in after fifteen minutes, with policies set up so that you're automatically logged off an hour after your quitting time.
Yeah... I did that once...
It's easy enough to do, a couple clicks of the mouse. Group Policy lets you do all sorts of stuff. Set it up to lock the computers after about 15 minutes of inactivity, and log everyone off about an hour after closing time. Seemed like a great idea to me, especially since it was a medical office and they had expressed numerous concerns about security and confidentiality.
Then the screaming started. Folks would walk away from their computers and come back to a locked screen...
Re: (Score:2)
You got that in writing, right? So you have some lawsuit insurance when someone figures out how easy it would be to steal some identifying information and they blame the IT guy?
Re: (Score:2)
Or someone would walk away for an hour or two without logging off, and someone else would have to use their computer while they were gone.
Doesn't windows support multiple sessions, these days? Leave their session alone and log in to yours. "Switch user", I think it's called.
They didn't even want the account to automatically log off after work, because it was easier to leave everything up and running overnight and come back to it in the morning...
What about automatically locking, at least?
But yes, I aggree with zippthorne -- get it in writing, especially if you can get them to sign something along the lines of "I understand that this will significantly decrease security, below what many professionals consider to be acceptable."
Re: (Score:3, Insightful)
Then the screaming started. Folks would walk away from their computers and come back to a locked screen... But they wouldn't know how to log in. They didn't know what username and password to put in there because it looked ever so slightly different from what they saw when they first showed up in the morning.
You have to have the cooperation of the people at the top of the organization, who would send a memo to everyone saying that for security reaons, this is what you WILL do, and failure will result in dis
Electronic Noses ... (Score:2)
CC.
Re: (Score:2)
I set my screensaver to appear after 5 minutes, and then lock after 10 seconds. If I see the screensaver starting I just touch the mouse and I can snoozy another 5 minutes. Don't know if it works with Windows, but I like the (KDE) option very much.
Re: (Score:3, Interesting)
Kbluelock.
Smartcards (Score:2)
In organisations where data is sensitive they use smartcards.
If you make the same smartcard open the doors to the building then you ensure that nobody will leave it in their PC while they go out for a break.
applies the burninator (Score:2)
Re: (Score:3, Informative)
Article states the obvious (Score:3, Insightful)
Designing systems for usability is hard, especially when security is involved.
Meh.. I was hoping for some deeper insights than that.
Re: (Score:2)
Deeper would be nice, but being that usability is one of if not the single largest problem in the computing world, its probably good if we focus on the basics for a while, until everyone at least gets that part of it.
Solutions that work, but are too bulky. (Score:5, Informative)
Back before ease of use eclipsed security, I once encountered a military system where the access terminal was surrounded by a small fence. Opening the gate in the fence forced an immediate logout.
Nobody would tolerate that today. Except, maybe, for an ATM.
Re:Solutions that work, but are too bulky. (Score:4, Insightful)
Reauthenticate when suspicious (Score:4, Interesting)
If you really do need to do this kind of thing (I suppose people sometimes do have legitimate requirements to wire large amounts of money to offshore accounts), it's not a big hassle to log in again.
Re: (Score:2)
That always annoys me. No one should be able to steal my session, if it's encrypted (replace with "session cookie" and "https" if we're talking about the Internet) -- if they could, they could probably steal my password, too. If they've got my password, that's a trivial annoyance. And if you're worried about leaving people logged in, add an inactivity timeout.
MS solved this problem, but removed it with W2K+ (Score:5, Funny)
Windows 95/98/ME had a built-in solution to this problem, but MS removed it in the Win 2K and newer. They simply had the machine crash every 2 hours. Heavy handed, sure, but it worked.
It still works in XP (Score:3, Funny)
At least it does on my compu[BSOD graphic goes here]
Re:It still works in XP (Score:4, Funny)
Re: (Score:2)
Re: (Score:2)
If you have an Android-based phone, Vista supports user-initiated remote crashing with a third-party tool.
That Microsoft, always thinking ahead and innovating the features users really want! You don't see Linux with that feature! I hope Microsoft patents the hell out of that so noone else can use it.
Microsoft, we innovate the HELL outta your ass! :)
This is more a policy issues then a technical one (Score:3, Insightful)
While yes, there are technical measures that you can put in place to automatically lock screens and accounts and such after a pre determined time period, the best solution is a policy, and actual enforcement of that policy. There in lies the problems in many organizations, enforcement is not being done consistently.
With technical controls, there is always that time frame, for example idle accounts, usually 30 days from last login and then automatically lock the account, well a malicious user has 30 days to which to attempt access to that account. Same goes for screen locks, 15 min is a common default, well you walk away and I have 15 min to make my way over and have fun with the account. You can reduce the amount of time, but that has other issues, users get annoyed at the screen locking while they are on the phone, or whatever while they are at their desk, results in crappy passwords.
With a policy, and enforcement behind it, accounts can be removed, users will lock their screens (hopefully) within a timely manner.
xlock (Score:2)
Or rather the locking option of xscreensaver has worked very well for years for me. You just need to make it a habit.
Otherwise logging out has been solved for half a century now, just use a reasonably security aware OS.
Pwning (Score:2, Interesting)
In my office an unlocked computer is fair game for harmless pranks that have become known simply as pwning.
Nothing too nasty happens as the shame is in having been pwnd, not in the severity of damage inflicted.
There, my computer just announced "it's one thirty" in a robot voice. Nice. Thanks a lot, guys.
Put the onus on the client (Score:3, Informative)
You make the client system re-authenticate after a configurable amount of time, and that authentication comes via central storage of authentication passwords/tokens. For example, Keychain.
My laptop is set up with SSHKeychain, and it has options for locking my Keychain. If I activate the screensaver and don't come back within 3 minutes or so, it locks the keychain, and any program that wants to use a stored password triggers a password authenticaton dialog box for the system keychain password.
This puts the power of security in the hands of the user or organization. Computer at home, no roommates? Probably not an issue to lock your keychain any time except when you shut down your computer. Work in a cube? After 5-10 minutes of inactivity or whenever you lock your screensaver.
Location based devices.. (Score:3, Informative)
Some places use smartcards, the card must be in the slot or it locks your screen... The same card is also used to open the doors so if you leave the room without taking the card then you can't get back in. Most people had the card attached to their belt or similar.
Another idea is to track the location of your phone using bluetooth (10 meters range), if you walk too far away it loses signal and locks the screen.
This is De-Authorizing, not De-Authenticating (Score:4, Interesting)
RFID (Score:2)
Enforced Group Polcies (Score:2)
Our Group Policy is set to auto-lock the system after 15 minutes of non-use. Everyone gets it, almost no exceptions.
Bring the hammer!
Bluetooth auto-lock when you walk away (Score:2)
Salling Clicker is an app that will auto lock when it loses the Bluetooth signal from a device like your phone. Instant auto lock when you walk off as long as your phone is on you.
It can also unlock when you return, but thats obviously dangerous in a few different ways since it effectively makes your bluetooth device a token for authentication and that is easy enough to clone off.
http://www.salling.com/clicker/ [salling.com]
The problem is you have to have it installed and your phone/device must be paired. This is accep
Firewall logout (Score:2)
Our PHB IT's went very tight on network security. (haha) User's have to authenticate with the firewall every 12 hours. They originally wanted 8 hours. We pointed out that the main users (R&D), would work 10-12 hours a day. Everyone else is on a different network. It slows down starting up a windoze PC, every morning by about 10-20 minutes, as many taskbar apps, automatically start-up and check the network for updates. We have removed auto-connecting networks disks and moved them to a script, started man
TLS/SSL (Score:2)
I'm less interested in being de-authenticated from my web logins. I'm much more interested in finding a way to deauthenticate website security certificates. When a malicious website obtains a security certificate, how do you remove it?
Re: (Score:3, Informative)
Re:How do you un-authenticate? (Score:5, Insightful)
Think of a remote connection to Remote Desktop for Windows. When does the server know when to sever the connection? Is it after some time delay of minimal activity? If it's left authenticated for time X, and the ability for the traffic to be hijacked is Y, are X and Y proportional?
It's not as simple as I walk away from a physical machine anymore. My favorite is when an application doesn't close when you press the X in windows (upper right) or OS X (upper left). It's connections are still left open, leaving authentication on opening the application worthless.
Re: (Score:3, Insightful)
On a Mac, that closes the window, but the application is still running.
Re: (Score:2)
Re: (Score:2)
Using Salling Clicker, if you unlock without a bluetooth signal, it just doesn't do anything. It has to start talking to a bluetooth device before it will lock for not having one.
You still get the annoying lock when your battery dies, but you just unlock it and move on, without the safety net of auto-lock when you leave next time.
Its good stuff if you need that sort of thing, its been a few years since I was in a position to actually require that level of security so I haven't used it in a while.
http://www [salling.com]
Re: (Score:3, Interesting)
I have no idea how to do it in bash, but you can easily lock a computer from the command line in Windows.
rundll32.exe user32.dll,LockWorkStation
Another one:
rundll32.exe shell32.dll,SHExitWindowsEx [0|1|2|4|8]
0: logoff, 1: shut down, 2: reboot, 4: forced shutdown, 8: powers down the machine
This would be a fun one to put in the Startup menu of someone who left their PC unlocked, actually... :D