I was always a proponent of hardware security devices due to their hard to copy or steal undetected nature. The human factor, though, seems to play the biggest role in this form of authentication as well, and here's why:
Pros losing confidence in hard tokens
I should notice that hardware token such as OTP generator is no security by itself. Such devices must be password- or PIN-protected, so that if the device is lost, it becomes useless. PKCS#11 devices (USB cryptotokens and cryptocards) include such protection on board, and probably this is why they are not mentioned in this articles. Simple access control devices such as pass cards, don't have sufficient protection though. And this can lead to lowered confidence in all types of devices, including strongly protected ones
Tuesday, December 13, 2011
Pros losing confidence in hard tokens
Thursday, October 13, 2011
Possible alternative to CA hierarchy
Convergence. If you didn't hear about it before, don't worry - so did(n't) we. This is a new invention presented on a conference just a couple of months ago. It aims to make MITM (man-in-the-middle) attacks, which are necessary to make use of the fake SSL certificate, useless. How does it do this?
MITM attack is local, i.e. it can affect usually a limited number of clients. Other clients (in other areas of the world) are not affected. So if our client calls other clients (called notaries here) and asks "do you see what I see?" (i.e. do you get the same certificate from that site), it ensures that the certificate is authentic OR it detects MITM attack. Of course, there exist some technical complexities here, but they are just minor details.
Convergence is a good case of proper use of peer-to-peer technologies, which makes complex (and expensive) CAs completely unnecessary.
The only question left is "who will guard the guards". If MITM can fake server's certificate, how do you ensure that notary's response to your request has not been forged? MITM attacker will quickly pay attention to forging notaries' certificates as well and producing valid response. So the large number of notaries is required, with possibility to switch them on the fly for each new request which needs validating.
Read more details about Convergence on Convergence homepage
Wednesday, August 31, 2011
Javascript Cryptography Considered Harmful
The article discusses why implementing any cryptography in JavaScript gives no security and, what's even worse, gives a feeling of false security.
Hackers acquire Google certificate, could hijack Gmail accounts
The conceptual problem is that PKI stands on the trust to companies that issue certificates (CA). When there were few CAs and they did their job, everything was fine. As the number of certificates issued increased, CAs started to outsource their work to resellers and lower their cost by automating certificate issuance. So now this kind of problems will happen again and again.
Read the story and today's official statement (which proves my words -- if the computer issuing the certificates would not be connected to network, the trouble would not happen).