It appears that the benefit of 2-factor
authentication is broadly recognized, not the least because Onetime Passwords (OTP)
can now be sent to smart phones by SMS at very low costs. The benefit is indeed remarkable when the
users are in the indoor environment. Is
the benefit the same when the users are in the outdoor environment?
What can be relied upon in a dangerous
environment can be relied upon in a safe environment, but we cannot say that
the reverse is also true. I mean that
the indoor environment is relatively much safer than the outdoor.
Some banks tell us that it is a “mistake”
to carry a bank card together with a paper with the PIN on it. Then it should
also be a mistake to carry a mobile computer, tablet or phone together with a
paper with the password on it. Replace
such a paper with a token generating OTP or a phone receiving OTP, and what
conclusion do you think you would reach?
The PIN/password on a paper proves the
identity of the paper, not the identity of the person who holds the paper. OTP
generated on a token proves the identity of the token, not the identity of the
person who holds the token. OTP received
on a phone proves the identity of the phone, not the identity of the person who
holds the phone. The structure is the
same in all of them.
Those banks abovementioned may be wrong in
using the word “mistake”,, but we could at least learn that the 2-factor
authentication in the outdoor environment is not as beneficial as in the indoor
environment, and that, in the outdoor environment, what matters most is the
security of remembered PIN/password rather than the reliability of a
PIN/password written on a paper or a OTP generated on a token or a OTP received
on a phone.
Whether or not we use
OTP-generating/receiving tokens/phones, it should be imperative to enhance the
remembered password itself if we want the safe cyber-life in the outdoor
environment.
Making use of episodic/autobiographic image
memory will help. Sharing many of the
drawbacks with textual passwords, simple pictorial password systems had been a
disappointment, but those drawbacks can be overcome by the use of
episodic/autobiographic memories and by offering shoulder-surfing proof
functions.
Incidentally, ehancing the remembered
password is not exclusive to using OTP.
It is possible to regenerate OTP from the texts randomly allocated to
the pictures of episodic/autobiographic memories, and one of our alliances has
already started to market such a 2-factor authentication system incorporated in
a Single-Sign-On solution.
The assertion that a carried password, PIN, or token generator authenticates the carrying physical medium, I accept.
ReplyDeleteHowever, the implication that, due to the relatively lower physical safety level of the outdoor (that is to say, the less controlled, by our legitimate subject) environment, should necessarily imply that we must re-focus on the remembered password/PIN instead of continuing to rely on the second factor, I argue is somewhat misplaced.
Yes, if someone steals my wallet, and in my wallet I have a piece of paper, and on that paper I have written my PIN, then the physical possession of my wallet subverts all of the security of the PIN. (Though, if I have not written the identifying information, then the possession of the PIN itself is of little or no use to the thief. One of my banks uses coordinate cards as a semi-2nd factor of authentication; the card has no account nor personal identifying information on it, and I do not carry my bank account number in my wallet. In fact, I don't carry the coordinate card in my wallet - I carry a scan of it inside my locked mobile device! And of course the related PIN/password is not in there at all - that part, I remember).
But if someone steals my encrypted, password locked smartphone, and that someone is not the NSA, CIA, GRU, MI6, etc which has the necessary high capacity and targeted desire to be able in a practical way to pierce that technical security veil, then the theft of my smartphone gives the thief ... nothing of information about me, my bank accounts, PINs, token generation, etc.
There are many compensating controls for most risks. A very appropriate compensating control for the risk of theft of token generators is to have a security wrapper around the token generator (encrypt if possible, and password lock in any case, the device), along with never storing the identifying data of the user or account with the token generator.
This is not to say, not at all, that we do not need better password mechanisms, which allow the human user to more easily remember a password (and all the better if the mechanism not only allows easier memory but also easier memory of stronger passwords). We do.
I take issue only with the implication that we must re-balance token generators with stronger passwords because of the routine risk of theft/loss in the outdoor world. In this case, the two are complementary and desirable, and the second is not the most relevant compensating control for a risk to the first.
saludos,
Jay Libove, CISSP, CIPP, CISM
Barcelona, Spain