Entries tagged as 'multifactor'
all
Posted Monday, 2 June 2008
I briefly used a PayPal security key, but it was a frustrating experience, simply because I kept leaving the key at home. PayPal’s integration with eBay is not good, which is surprising as eBay owns PayPal.
When I decided to stop using the key, I was able to cancel the PayPal key online in a matter of minutes. It took a 15 minute live chat with an eBay rep to remove the PayPal security key from my eBay account. Perhaps that was a security step by eBay. However the frontline system for canceling the key on eBay’s site did not work properly.
The worst part of the PayPal key: I had to pay US$5 to get one in the first place. If PayPal really wanted business users to have multifactor keys, the first key would be free of charge.
Related posts and pages on billso.com
Tags:
authentication,
e-commerce,
eBay,
mobile,
multifactor,
openid,
password,
paypal,
trust
all
Posted Tuesday, 13 May 2008
The mobile phone is an excellent device for two-factor authentication. Most Internet users already have a mobile phone. A user might not notice that they’ve lost a dongle. security token or smartcard. That’s one reason adoption has been difficult for multifactor authentication schemes.
JanRain announced on 9 May 2008 that it is launching a phone-based multifactor authentication service, CallVerifID, that works with its myOpenID service.
The phone verification service lets a user designate a specific phone number that JanRain’s partner, PhoneFactor, will call when their username requires verification. The user can press the pound (#) key on the phone to confirm the login, or use the incoming call to report that their username has been compromised.
Users can designate a mobile or landline number for their verification calls by setting up their myOpenID account preferences with the appropriate number.
The system isn’t perfect. Someone could still learn the users OpenID URL and passphrase, and arrange to intercept the confirmation phone call somehow. This might take a greater level of physical access than stealing a security key or snooping a keyboard. The call verification system could easily be improved by asking the user to enter or speak a second passphrase on the phone.
As Chris Messina pointed out in December 2007, several large Internet content companies have announced that they will support OpenID. Their implementation has been delayed. for several reasons, including branding, although ma.gnolia finally came through in March 2008.
CallVerifID is more evidence that OpenID can become a trusted authentication platform for content and blogging sites, and perhaps for e-commerce sites as well.
See CenterNetworks and Mashable and for more details.
Mobile phone image courtesy of besto-Baker on Flickr, through a Creative Commons license.
Related posts and pages on billso.com
Tags:
authentication,
blogging,
e-commerce,
eBay,
mobile,
multifactor,
openid,
password,
paypal,
phone,
security,
telecom,
voice
ism tech
Posted Thursday, 17 April 2008
Read 1 comment
From Lifehacker comes a link to a free virtual keyboard called Neo’s SafeKeys. The keyboard is displayed on the computer screen, and lets a Windows user type their password without accessing the computer’s keyboard.
It’s trivial to monitor keystrokes through software and hardware called keystroke loggers or keyloggers. This New York Times describes a new phishing attack against executives, involving an email with a link to a fake subpoena. Click the link and a Windows keystroke logger gets installed.
Executives are excellent targets for such attacks. CXOs often want to bypass corporate security systems for the sake of personal convenience. When executives insist on carrying confidential or valuable corporate data on their laptop’s hard drive, they may as well paint a target on their foreheads.
CXOs might also disable virus scanners and security software to make the computers run faster. This only makes their personal computers much more vulnerable. When executives are reluctant to admit their mistakes or ask for help, the damage is already done.
I’ve seen virtual keyboard systems deployed on banking web sites, so that users can use a mouse to enter their passphrase. Of course, this can be very tedious if the user has a long passphrase. These virtual keyboard systems may become more common as banks implement multifactor authentication schemes that address consumer, regulator and compliance issues.
Keyboards and keystrokes
It’s still possible to use a keyboard for multifactor authentication, however. This article from Windows in Financial Systems describes a system from BioPassword that requires the user to enter their password ten times in a single enrollment session. Software determines the rhythm of their keystrokes, and stores that data along with the user’s account on a Microsoft Active Directory server. Anyone who tries to access the account will have to simulate that user’s typing behavior for that specific password.
In this 15 May 2007 article, ha.ckers.org pointed out some potential problems with BitPassword’s system. The timing needs to be loose enough to accommodate different keyboard styles. A laptop computer’s keyboard often is laid out differently from a standard desktop keyboard. otherwise, the timing checker might flag users who include numerics, international characters (such as € £ ß Ω) and typographical symbols (like % @ © ^#~) in their passphrase.
Dots and dashes
The concept dates back to the 19th century. Experienced telegraph operators could identify each other by through their fist, or their distinctive patterns of keying Morse code. The same concept was also used during both World Wars to match radio operators with their message content.
Some banks might have each user to enroll several different passphrases, as many banks now require for their web-based customer portals.
BioPassword’s software is designed for business and enterprise users. PC Magazine has an excellent review here, and the London Times and Baseline have good recent articles. This Wired article from 2000 describes how the system was used by a Canadian company, Musicrypt.com, as part of a user management service for music web sites.
Related posts on billso.com
Tags:
ADA,
authentication,
banking,
biometrics,
crime,
keyboard,
Microsoft,
multifactor,
music,
password,
phishing,
security,
unicode,
Windows
