[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 10 Jun 2016 09:36:14 -0500
From: Jeffrey Goldberg <jeffrey@...dmark.org>
To: passwords@...ts.openwall.com
Subject: Re: Authentication vs Identification
On 2016-06-10, at 6:17 AM, e@...tmx.net wrote:
[Snipping a long, but important, rant about the errors of confusing identifiers with authentication.]
> These characteristic properties are completely mutually exclusive (can you imagine something more mutually exclusive than that?!), this is why you must send to hell everyone who dares to propose you any piece of biometric data as your auth token.
The examples that I use for the dangers of using (knowledge of) identifiers as proof of authenticity are the history of Social Security numbers in the US and of credit card numbers.
Social Security numbers are record locators, but when retail banks in the US started offering some banking services by phone, they decided to use knowledge of social security numbers for authentication.
Similarly, credit card numbers were also designed as identifiers for particular accounts and were never meant to be kept secret. It is only when shopping by phone became a thing (late night TV adverts in the US in the 1970s and 1980s) that knowledge of a credit card number was used for authentication.
Both of these cases illustrate the trouble we can get into when we start to use knowledge of identifiers for authentication.
I wrote a little bit about this a few years back in
https://blog.agilebits.com/2012/07/03/check-out-my-debit-card-or-why-people-make-bad-security-choices/
Cheers,
-j
–-
Jeffrey Goldberg
Chief Defender Against the Dark Arts @ AgileBits
http://agilebits.com
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
