WebApp Sec mailing list archives
RE: Entrust - Identity Guard - Any experience?
From: "Rishi Pande" <rishi.pande () gmail com>
Date: Fri, 19 Aug 2005 14:50:30 -0400
I guess the big question that you have to answer is why you do not want a token solution. Is it because tokens have to be maintained or is it just cost prohibitive? There are solutions that can do two-factor without a token. You may want to look into those. Good luck! -----Original Message----- From: Ellis, Steven [mailto:steven.ellis () cgi com] Sent: Friday, August 19, 2005 2:04 PM To: webappsec () securityfocus org Subject: RE: Entrust - Identity Guard - Any experience? Of course you just drop the "what you have" card on the nearest photocopier and now there are two or more of you. The truth is security costs and that cost must be justifiable. I could not see this technology in use at companies that have high value data but a small or medium size business where money is tight. Just my $.02 -----Original Message----- From: Dwayne Taylor [mailto:DTaylor () rdacorp com] Sent: August 19, 2005 1:06 PM To: SB; webappsec () securityfocus org Subject: RE: Entrust - Identity Guard - Any experience? The product link below shows something that focuses more on using a combination of direct authentication and challenge/response rather than two factor authentication. True two factor authentication based both on what a user knows and what a user has (such as an X.509 cert/private key or device that produces one-time passwords) "black boxes" the "what a user has" element, so that the user requires the device to satisfy the requirement of something they have for the second authentication factor. This product's form of "what a user has" is risky because the challenge/response values can be easily obtained and used by an attacker without actually possessing the object required to satisfy the requirement. Understandably, it looks like this company is trying to get into the market niche of those who want something stronger than username/password but something more cost effective than the smartcard/key fob type solutions that require more $$$$. My $.02 ________________________________ From: SB [mailto:vidyabalaji () gmail com] Sent: Fri 2005-08-19 08:21 To: webappsec () securityfocus org Subject: Entrust - Identity Guard - Any experience? Hi! I am looking for insights from you security professionals into implementing a two factor option that does not require shipping a token. Something similar to http://www.entrust.com/identityguard/index.htm has anyone had experience with this? Any known security issues with this approach. This will be in addition to the person's user name and password. Thanks very much for your help. Sri Balaji.
Current thread:
- Entrust - Identity Guard - Any experience? SB (Aug 19)
- <Possible follow-ups>
- RE: Entrust - Identity Guard - Any experience? Dwayne Taylor (Aug 19)
- Re: Entrust - Identity Guard - Any experience? Saqib Ali (Aug 19)
- RE: Entrust - Identity Guard - Any experience? ken kousky (Aug 20)
- Re: Entrust - Identity Guard - Any experience? Saqib Ali (Aug 19)
- RE: Entrust - Identity Guard - Any experience? Ellis, Steven (Aug 19)
- RE: Entrust - Identity Guard - Any experience? Rishi Pande (Aug 19)
- RE: Entrust - Identity Guard - Any experience? Mary Ann Burns (Aug 19)
- Re: Entrust - Identity Guard - Any experience? Saqib Ali (Aug 19)
- Re: Entrust - Identity Guard - Any experience? Ralf Durkee (Aug 19)
- RE: Entrust - Identity Guard - Any experience? Lyal Collins (Aug 20)
- Re: Entrust - Identity Guard - Any experience? Saqib Ali (Aug 21)
- RE: Entrust - Identity Guard - Any experience? ken kousky (Aug 21)
- Re: Entrust - Identity Guard - Any experience? Ned Fleming (Aug 22)
- Re: Entrust - Identity Guard - Any experience? Saqib Ali (Aug 23)