Secret question - hole in security
Published by Evil Bee Monday, 07 July 2008 23:34
It's a mystery to me why websites think "secret questions" are a good idea. We sign up for an online service, choose a hard-to-guess (and equally hard-to-remember) password, and are then presented with a "secret question" to answer.
Twenty years ago, there was just one secret question: what's your mother's maiden name? Today, there are several: what street did you grow up on? what's the name of your favorite teacher? what's your favorite colour? Often, you get to choose.
The idea is to give customers a backup password. If you forget your password, then the secret question is a way to verify your identity. It's a great idea from a customer service perspective - users are less likely to forget their first pet's name than some random password - but terrible for security.
Customers, passwords, and web sites
Published by Evil Bee Monday, 07 July 2008 23:12
Criminals follow money. Today, more and more money is on the Internet: millions of people manage their bank, PayPal, or other accounts-and even their stock portfolios-online. It's a tempting target-if criminals can access one of these accounts, they can steal a lot of money.
And almost all these accounts are protected only by passwords.
You already know that passwords are insecure. In the book Secrets and Lies (published way back in 2000), Bruce Schneier wrote: "...password crackers can now break anything that you can reasonably expect a user to memorize."
On the Internet, password security is actually much better than that, because dictionary attacks work best offline. It's one thing to test every possible key on your own computer when you have the actual ciphertext, but it's a much slower process when testing remotely. And if a Web site's creators are halfway clever, the site would shut down an account if there were too many incorrect password attempts in a row.
This is why criminals have turned to stealing passwords.
Theoretical Cryptography - MD5
Published by Evil Bee Friday, 27 July 2007 14:08
Since Martin constantly manages to cover all ongoing news regarding cryptography and security I myself planned on writing about “any time soon”, I had to look for other topics on the subject I could cover. So I decided to make good use of all the time I spend studying this kind of stuff and share this knowledge with you. And I would be very grateful, if someone could tell me in return how to defeat shirred fabrics with my sewing machine… but that’s a whole different matter.
So for the first Part of this - hopefully ongoing - series, I decided to look at the MD5 hash algorithm. It’s one of the most commonly used cryptographic algorithms out there and I would claim that nearly everyone has a password somewhere that is stored with an MD5 or similar hash.
Secure passwords keep you safer
Published by Evil Bee Monday, 15 January 2007 00:00
Ever since I(Bruce Schneier) wrote about the 34,000 MySpace passwords I analyzed, people have been asking how to choose secure passwords.
My piece aside, there's been a lot written on this topic over the years -- both serious and humorous -- but most of it seems to be based on anecdotal suggestions rather than actual analytic evidence. What follows is some serious advice.
The attack I'm evaluating against is an offline password-guessing attack. This attack assumes that the attacker either has a copy of your encrypted document, or a server's encrypted password file, and can try passwords as fast as he can. There are instances where this attack doesn't make sense. ATM cards, for example, are secure even though they only have a four-digit PIN, because you can't do offline password guessing. And the police are more likely to get a warrant for your Hotmail account than to bother trying to crack your e-mail password. Your encryption program's key-escrow system is almost certainly more vulnerable than your password, as is any "secret question" you've set up in case you forget your password.
Two-factor authentication: too little, too late
Published by Evil Bee Thursday, 07 April 2005 23:40
Two-factor authentication isn't our savior. It won't defend against phishing. It's not going to prevent identity theft. It's not going to secure online accounts from fraudulent transactions. It solves the security problems we had 10 years ago, not the security problems we have today.
The problem with passwords is that it is too easy to lose control of them. People give their passwords to other people. People write them down, and other people read them. People send them in email, and that email is intercepted. People use them to log into remote servers, and their communications are eavesdropped on. Passwords are also easy to guess. And once any of that happens, the password no longer works as an authentication token because you can never be sure who is typing in that password.
Cryptanalysis of MD5 and SHA: time for a new standard
Published by Evil Bee Monday, 19 April 2004 00:12
At the Crypto 2004 conference in Santa Barbara, Calif., this week, researchers announced several weaknesses in common hash functions. These results, while mathematically significant, aren't cause for alarm. But even so, it's probably time for the cryptography community to get together and create a new hash standard.
One-way hash functions are a cryptographic construct used in many applications. They are used with public-key algorithms for both encryption and digital signatures. They are used in integrity checking. They are used in authentication. They have all sorts of applications in a great many different protocols. Much more than encryption algorithms, one-way hash functions are the workhorses of modern cryptography.
Read more: Cryptanalysis of MD5 and SHA: time for a new standard
Voting security
Published by Evil Bee Monday, 09 February 2004 23:38
Voting seems like the perfect application for technology, but actually applying it is harder than it first appears. To ensure that voters can vote honestly, they need anonymity, which requires a secret ballot. Through the centuries, different civilizations have done their best with the available technologies. Stones and pottery shards dropped in Greek vases led to paper ballots dropped in sealed boxes. Mechanical voting booths and punch cards replaced paper ballots for faster counting. Now, new computerized voting machines promise even more efficiency, and remote Internet voting promises even more convenience.
An ideal voting technology would have four attributes: anonymity, scalability, speed, and accuracy-a direct mapping from voter intent to final tally. But in the rush to improve the first three attributes, accuracy has been sacrificed. All voting technologies involve translating the voter's intent in some way, many of them multiple times. And at each translation step, errors accumulate.