Re: [Full-disclosure] PassMark?

[Q-Ball]

I would agree as well, having recently reviewed them with others in the same field. Apart from relying on users to only enter their password if they saw an image, the solution heavily relied on cookie usage. This works fine for most people but a lot of corporate environments have persistant cookie polices so this ends up being an annoyance and ineffective for this segment of users. It also makes it susceptible to keystroke loggers due to the ease of which the challange can be generated. I'd also have trouble justifying this as anything other than a 2 x 1-factor solution and as such it may not meet FFIEC guidlines.
The bigger issue, as with any other web based authentication solutions, is what does this protect you against and the answer these days is not a lot.

Q-Ball

On 6/13/06, Randal T. Rioux <[EMAIL PROTECTED]> wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Gary E. Miller wrote:
> Yo All!
>
> I thought I'd actually risk a real security question here.
>
> Any one seen the "PassMark" ( www.passmarksecurity.com) security system
> in action?
>

Yes.

Bank of Bangalore^H^H^H^H^H^H^H^H^HAmerica uses it, as well as a recent
financial client corp. of mine.

I'm not impressed with it.

Randy

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEjjYIRrGMQdCNGUERA5rnAJ94fz+ll9VzSazzp0zfhha8BwQURQCfYch0
o6/Swjo9ZIyc4Hsb7223koo=
=s8LO
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/