lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <242a0a8f0609092109o191c3d5fo227415155be32d04@mail.gmail.com>
Date: Sun, 10 Sep 2006 00:09:35 -0400
From: "Brian Eaton" <eaton.lists@...il.com>
To: "Lyal Collins" <lyal.collins@...2it.com.au>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: Re: RSA SecurID SID800 Token vulnerable by
	design

On 9/9/06, Lyal Collins <lyal.collins@...2it.com.au> wrote:
> If there's malware on the machine, and there is a connected USB token, then
> authentication is only as good as the password - malware can probe the
> connected token as often as desired.
<snip>
> In theory, with trusted data paths everywhere (internal to worksation as
> well as he network) OTP is better than passwords alone.  But since this data
> patch assumption is rarely 100% valid, OTP is as good as a password alone.
> In the situation where data paths are trust-able, OTP is a somewhat better
> than passwords alone.

If you think about it in terms of how long an attacker has to act, I
think you'll come to a different conclusion.  Two-factor auth is
better than password alone even when the end user is typing OTPs into
a machine that is completely and totally rooted.  The key phrase in
your analysis is "connected token."  Once the token is disconnected,
the malware no longer has access to the authentication data.  When a
password is stolen it could be usable for months.  When an OTP is
stolen it is usable for hours, if that.  Two-factor auth reduces the
risk because it reduces the length of time of the compromise.

> Does the risk justify the costs involved (tokens,
> token management, authentication host, and trusted data paths)?

That is the big question.  Even if you are willing to pay for
two-factor, transactional authentication might provide better value.

Regards,
Brian

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ