Date: Fri, 10 Jun 2016 17:21:16 +0200 From: "e@...tmx.net" <e@...tmx.net> To: passwords@...ts.openwall.com Subject: Re: Authentication vs Identification On 06/10/2016 04:36 PM, Jeffrey Goldberg wrote: > On 2016-06-10, at 6:17 AM, e@...tmx.net wrote: > > [Snipping a long, but important, rant about the errors of confusing identifiers with authentication.] > >> These characteristic properties are completely mutually exclusive (can you imagine something more mutually exclusive than that?!), this is why you must send to hell everyone who dares to propose you any piece of biometric data as your auth token. > > The examples that I use for the dangers of using (knowledge of) identifiers as proof of authenticity are the history of Social Security numbers in the US and of credit card numbers. Why do you think I do not have a credit card? :) I worked "hands-on" with this shit, and used to be involved up to the nostrils into this bank-related security theatre. It is a tough situation to sort out when every one who works with you is a fraud, and the biggest fraud is the anti-fraud department chief. (Also they are all imbeciles in my personal experience.) Another side of the story is a Layman. There is no way to explain an ordinary citizen that he is fucked up. -- Everybody uses it! -- I am not important. -- It can't be true, because my bank consultant said otherwise. -- What do you think all these numbers are for? fun? -- I have an additional layer of "security" in my contract. > Social Security numbers are record locators, this adds another layer of vulnerability. in a normal guessing attack a bad guy must locate a single record and then is "allowed" to guess a password. in a single-token situation the attack is automatically applied to the ENTIRE DATABASE: whatever record matches the guess. > but when retail banks in the US started offering some banking services by phone, i have an anecdote from my personal exp. our office was under security alarm system, and i happened to arrive before anyone else deactivated the system, i knew the algorithm but had no exp, consequently i set off the alarm. Then I immediately called the security to revoke the alarm. For this particular case there was a password, which was as usual written by call centre girls on a wall. I knew the location, but again had no exp. The wall appeared to be CLUTTERED WITH PASSWORDS. I picked one at random, and failed, i picked another one and failed again, and again... until the girl on the other end of the line get annoyed by me. She cried: -- What an idiot! your password is "XYZ!@#", is it so fucking difficult to remember? Good day. The alarm was revoked. > (late night TV adverts in the US in the 1970s and 1980s) that knowledge of a credit card number was used for authentication. they are not to blame. who ALLOWED THEM to run those transactions? and after this decision the banks demand a right to shift the fraudulent transaction risks from self to the clients. they accept FUNDAMENTALLY INSECURE transactions and then play innocent, and no single layman ever questioned them. who is responsible for setting up a flawed system? HACKERS! -e
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.