full-disclosure - Re: OpenID. The future of authentication on the web?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e172cd090803240802r4ac94835r16c68b631ef44595@mail.gmail.com>
Date: Mon, 24 Mar 2008 10:02:15 -0500
From: "John C. A. Bambenek, GCIH, CISSP" <bambenek.infosec@...il.com>
To: "Larry Seltzer" <Larry@...ryseltzer.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: OpenID. The future of authentication on the
	web?

For the automated low-hanging fruit attacks, they won't crack.  They're
simply trawling for passwords and rarely do they even think to cross-check.
For someone to spend the kind of thought and attention the victim has to be
specifically targetted.

Now, to be fair, I only advocate that strategy for "throwaway" accounts.
For instance, I don't really care if my account on digg gets cracked, I do
care if my bank account gets cracked.  So I use the throwaway for digg (or
other sites that just don't matter if they are compromised) and something
secure and unique for the banks and other important stuff.

The alternative is that someone uses the same password for EVERYTHING, crack
some forum and you've got bank account passwords too.

Long winded, but I'm not sure much OpenID would provide authentication for
I'd care about (admittedly I haven't looked in detail).

On Mon, Mar 24, 2008 at 9:58 AM, Larry Seltzer <Larry@...ryseltzer.com>
wrote:

>  >>For instance, S0m3p4ss!### where ### is a 3-letter acronym for the site
> they are accessing.  Still need only one password to remember and you don't
> necessarily have a single point of 0wnership anymore.
> I've never understood this strategy. Once I compromise your "S0m3p4ss!ama"
> password for amazon.com how long will it take me to figure out all your
> others?
>
> Larry Seltzer
> eWEEK.com Security Center Editor
> *http://security.eweek.com/* <http://security.eweek.com/>
> ** <http://blogs.pcmag.com/securitywatch/>*
> http://blogs.pcmag.com/securitywatch/<http://blogs.pcmag.com/securitywatch/Contributing>
> *
> Contributing Editor, PC Magazine
> larry.seltzer@...fdavisenterprise.com
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/