Re: Article on passwords in Wired News
Peter Gutmann wrote: >> An article on passwords and password safety, including this neat bit: >> >> For additional security, she then pulls out a card that has 50 >> scratch-off codes. Jubran uses the codes, one by one, each time she >> logs on or performs a transaction. Her bank, Nordea PLC, automatically >> sends a new card when she's about to run out. >> >> http://www.wired.com/news/infostructure/0,1377,63670,00.html > > One-time passwords (TANs) was another thing I covered in the "Why isn't the > Internet secure yet, dammit!" talk I mentioned here a few days ago. From > talking to assorted (non-European) banks, I haven't been able to find any that > are planning to introduce these in the foreseeable future. I've also been > unable to get any credible explanation as to why not, as far as I can tell > it's "We're not hurting enough yet". Maybe it's just a cultural thing, > certainly among European banks it seems to be a normal part of allowing > customers online access to banking facilities. My (European) bank uses "memorable information", an alphanumeric string provided by me, and they ask for three randomly chosen characters when authenticating online. There is also a fixed password. Not terribly secure, or terribly one-time, but it would defeat a simple keylogger or shoulder surfing attack, for instance. It doesn't give me the warm fuzzies, but it does mean I would use a dodgy terminal at least once if I was stuck in the badlands (and then change passwords etc.). -- Peter Fairbrother - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Article on passwords in Wired News
At 21:04 2004-06-06 -0400, Adam Fields wrote: On Sat, Jun 05, 2004 at 10:06:20AM +0530, Udhay Shankar N wrote: > Citibank in India experimented with a special case of this a few years ago > - "online credit cards" - basically, a credit card number valid for one use > only, which would be ideal for online purchasing. > > IIRC, the offering was withdrawn because there weren't enough takers. American Express still does this, although it's difficult to find and use. They call it "Private Payments". Actually, they just discontinued it too, as of end of may. Greg. Greg RoseINTERNET: [EMAIL PROTECTED] Qualcomm Australia VOICE: +61-2-9817 4188 FAX: +61-2-9817 5199 Level 3, 230 Victoria Road, http://people.qualcomm.com/ggr/ Gladesville NSW 2111/232B EC8F 44C6 C853 D68F E107 E6BF CD2F 1081 A37C - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Article on passwords in Wired News
On Sat, Jun 05, 2004 at 10:06:20AM +0530, Udhay Shankar N wrote: > Citibank in India experimented with a special case of this a few years ago > - "online credit cards" - basically, a credit card number valid for one use > only, which would be ideal for online purchasing. > > IIRC, the offering was withdrawn because there weren't enough takers. American Express still does this, although it's difficult to find and use. They call it "Private Payments". -- - Adam - http://www.adamfields.com - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Article on passwords in Wired News
At 02:19 AM 6/5/2004, Ernst Lippe wrote: What is that card? There are some schemes that use debit cards with an embedded smartcard. If you are referring to one of these schemes I don't think that they are more secure than TAN's. If it is a card that you carry along with you, the risk that it will be stolen is higher than the risk that some TAN's will be stolen, because in most cases you are able to store your TAN's in a safe place in your home. The only apparent advantage of using a card is the PIN, i.e. "something you know", but all internet banking application that I have seen require some form of password which has at least the same security as a PIN. If it really is a debit card, then the security is probably even worse. In several debit card schemes the PIN for cash transactions is the same as the PIN for web transactions ( if the users have the possibility to change either PIN, it is a safe bet that they will be both the same), and it it not at all difficult to determine the PIN in this case. there is two factor authentication: * something you have * something you know in this scenario we could conclude there are are a least 3-4 types of "something you know" authentication. * re-usable "shared-secret", things like run-of-the-mill account numbers .. where knowing the account number is sufficient to perform a fraudulent transaction. these are extremely attractive to criminals ... because merchants tend to aggregate them in transaction files ... so a single theft of the transaction file could represent an extremely huge return-on-investment (benefit/risk trade-off). some past discussion of this with regard to security proportional to risk: http://www.garlic.com/~lynn/2001h.html#61 * shared-secret, one-time account numbers. this is a fairly adequate counter-measure for the major fraud scenario ... harvesting merchant account files. there can still thefts/copying of individual account sheets, just like there can be thefts of individual cards. note however that the benefit/risk of individual thefts is orders of magnitude less than the merchant transaction file harvesting. as per the above url discussion of security vis-a-vis risk ... harvesting a merchant account file of re-usable account numbers may represent a $50m exposure ... and hundreds of thousands of dollars expense to a bank to block the affected accounts and re-issue new cards. one time numbers may represent little or no countermeasure to the individual vulnerability but it represents a countermeasure for the aggregate vulnerability that is several orders of magnitude larger and more expensive * something you have cards ... that are supposedly hard to counterfeit ... but changing technology over the years have made them more and more vulnerable, PINs with most of these existing cards have been somewhat "something you know" shared secret ... i.e. some flavor of it is transmitted to the financial institution. skimming technology captures the magstripe value as well as the entered PIN; counterfeit cards are then manufactored ... along with notation regarding the correct pin. this skimming also relies on re-useable values ... and skimming operations can be setup and automated to capture tends of thousands * newer generation of something you have cards with embedded chips and non-shared secret PINs ... i.e. the correct PIN has to be sent to the chip ... before the chip performs the correct operation. Some of these have acquired the "yes card" label in some parts of euro-press. transaction information is skimmed ... sufficient to create a counterfeit chip-card. these counterfeit chip-cards answer "yes" to everything ... i.e. whether the pin entered was correct, whether the transaction value is less than limit, etc. again the skimming process has been automated, allowing the capture of information for potentially thousands of counterfeit cards (the skimming can be identical to that used with magstripe cards). -- Anne & Lynn Wheelerhttp://www.garlic.com/~lynn/ - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Article on passwords in Wired News
On Friday 04 June 2004 02:24, martin f krafft wrote: > also sprach Peter Gutmann <[EMAIL PROTECTED]> [2004.06.03.1014 +0200]: > > One-time passwords (TANs) was another thing I covered in the "Why > > isn't the Internet secure yet, dammit!" talk I mentioned here > > a few days ago. From talking to assorted (non-European) banks, > > I haven't been able to find any that are planning to introduce > > these in the foreseeable future. I've also been unable to get any > > credible explanation as to why not, as far as I can tell it's > > "We're not hurting enough yet". Maybe it's just a cultural thing, > > certainly among European banks it seems to be a normal part of > > allowing customers online access to banking facilities. > > While these are definitely nice, I am not particularly pleased. For > one, they are only "what you have", and not anything else. > > I love the Swiss system, which is a token card and a reader, locked > with a PIN. You go to the web, get a challenge, run it through the > reader after inserting the card and entering the pin, then it spits > out the response, which you enter, and you're in... What is that card? There are some schemes that use debit cards with an embedded smartcard. If you are referring to one of these schemes I don't think that they are more secure than TAN's. If it is a card that you carry along with you, the risk that it will be stolen is higher than the risk that some TAN's will be stolen, because in most cases you are able to store your TAN's in a safe place in your home. The only apparent advantage of using a card is the PIN, i.e. "something you know", but all internet banking application that I have seen require some form of password which has at least the same security as a PIN. If it really is a debit card, then the security is probably even worse. In several debit card schemes the PIN for cash transactions is the same as the PIN for web transactions ( if the users have the possibility to change either PIN, it is a safe bet that they will be both the same), and it it not at all difficult to determine the PIN in this case. TAN's are probably somewhat more reliable than your card terminal, that needs batteries and is susceptible to hardware problems with the card, such as the electrical contacts of the smartcard. Also TAN's are somewhat more convenient for the user because they don't have to type the challenge into some device. Most such devices that I have seen had very small keyboards and displays that will be troublesome for users with visual or motoric handicaps. TAN's are susceptible to copying, while smartcards are at first sight not vulnerable to this threat. Some TAN lists are protected with a coating that must be scratched off, in this case it will be difficult to copy the list. Also with smartcards you will have to be very careful about the card terminals where you use the card. For mag-stripe cards fake terminals have become really popular in recent years, and there is no real technical reason why the same cannot be done for smartcards as well. When you can use the smartcard in a smartcard reader that is directly connected to a PC, it can also be used remotely by an attacker. So overall I don't think that there is a very big difference in security between TAN's and smartcards, and in certain circumstances TAN's could actually be safer. Ernst Lippe - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Article on passwords in Wired News
At 01:44 PM 6/3/2004, Peter Gutmann wrote: One-time passwords (TANs) was another thing I covered in the "Why isn't the Internet secure yet, dammit!" talk I mentioned here a few days ago. From talking to assorted (non-European) banks, I haven't been able to find any that are planning to introduce these in the foreseeable future. I've also been unable to get any credible explanation as to why not, as far as I can tell it's "We're not hurting enough yet". Citibank in India experimented with a special case of this a few years ago - "online credit cards" - basically, a credit card number valid for one use only, which would be ideal for online purchasing. IIRC, the offering was withdrawn because there weren't enough takers. Udhay -- ((Udhay Shankar N)) ((udhay @ pobox.com)) ((www.digeratus.com)) - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Article on passwords in Wired News
also sprach Peter Gutmann <[EMAIL PROTECTED]> [2004.06.03.1014 +0200]: > One-time passwords (TANs) was another thing I covered in the "Why > isn't the Internet secure yet, dammit!" talk I mentioned here > a few days ago. From talking to assorted (non-European) banks, > I haven't been able to find any that are planning to introduce > these in the foreseeable future. I've also been unable to get any > credible explanation as to why not, as far as I can tell it's > "We're not hurting enough yet". Maybe it's just a cultural thing, > certainly among European banks it seems to be a normal part of > allowing customers online access to banking facilities. While these are definitely nice, I am not particularly pleased. For one, they are only "what you have", and not anything else. I love the Swiss system, which is a token card and a reader, locked with a PIN. You go to the web, get a challenge, run it through the reader after inserting the card and entering the pin, then it spits out the response, which you enter, and you're in... Simple, efficient, secure. -- martin; (greetings from the heart of the sun.) \ echo mailto: !#^."<*>"|tr "<*> mailto:"; [EMAIL PROTECTED] invalid/expired pgp subkeys? use subkeys.pgp.net as keyserver! "you raise the blade, you make the change you rearrange me till i'm sane. you lock the door, and throw away the key, there's someone in my head but it's not me." -- pink floyd, 1972 signature.asc Description: Digital signature
Re: Article on passwords in Wired News
Eugen Leitl wrote: Banks tried to push smart cards, but very half-heartedly (didn't offer free readers, which could have created critical mass). Ther was one of those "net-only" bank-like operations in the last days of the bubble that did offer free smart-card readers. That's what prompted me to sign up. Of course, the bubble burst and I never did get my free reader. -- Roy M. Silvernail is [EMAIL PROTECTED], and you're not Never Forget: It's Only 1's and 0's! SpamAssassin->procmail->/dev/null->bliss http://www.rant-central.com - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Article on passwords in Wired News
On Thu, Jun 03, 2004 at 08:14:39PM +1200, Peter Gutmann wrote: > One-time passwords (TANs) was another thing I covered in the "Why isn't the > Internet secure yet, dammit!" talk I mentioned here a few days ago. From > talking to assorted (non-European) banks, I haven't been able to find any that Customers hate PINs/TANs (have to carry then around, PINs typically are not alphanumeric, and fixed-length, print is low-contrast). Which is why power users have a (Windows-only, for some reason couldn't get GNUcash working, despite right crypto libraries and proper port punched through firewall) HBCI software alternatives. Which are not used widely, alas. Banks tried to push smart cards, but very half-heartedly (didn't offer free readers, which could have created critical mass). Now some folks are trying to use existing smartcard-authenticated mobile phone infrastructure for online payments, but it has its own problems (Bluetooth/IrDa, security, fax effect, etc). -- Eugen* Leitl http://leitl.org";>leitl __ ICBM: 48.07078, 11.61144http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net pgpp37oZjAHGy.pgp Description: PGP signature
Re: Article on passwords in Wired News
>An article on passwords and password safety, including this neat bit: > > For additional security, she then pulls out a card that has 50 > scratch-off codes. Jubran uses the codes, one by one, each time she > logs on or performs a transaction. Her bank, Nordea PLC, automatically > sends a new card when she's about to run out. > >http://www.wired.com/news/infostructure/0,1377,63670,00.html One-time passwords (TANs) was another thing I covered in the "Why isn't the Internet secure yet, dammit!" talk I mentioned here a few days ago. From talking to assorted (non-European) banks, I haven't been able to find any that are planning to introduce these in the foreseeable future. I've also been unable to get any credible explanation as to why not, as far as I can tell it's "We're not hurting enough yet". Maybe it's just a cultural thing, certainly among European banks it seems to be a normal part of allowing customers online access to banking facilities. (If anyone from the outside-Europe banking industry can provide me with an explanation for non-use of TANs that goes beyond "We're looking into it", I'd be interested in hearing from them). Peter. - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Article on passwords in Wired News
FYI, /. has posted a story on this, but, true to form, they confuse one time passwords with one time pads. Perry - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Article on passwords in Wired News
An article on passwords and password safety, including this neat bit: For additional security, she then pulls out a card that has 50 scratch-off codes. Jubran uses the codes, one by one, each time she logs on or performs a transaction. Her bank, Nordea PLC, automatically sends a new card when she's about to run out. http://www.wired.com/news/infostructure/0,1377,63670,00.html -- Perry E. Metzger[EMAIL PROTECTED] - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
