RE: Two-Factor Authentication on the Web

[<PPowenski () oag com>]

http://www.theregister.co.uk/2005/04/04/fingerprint_merc_chop/

Carjackers swipe biometric Merc, plus owner's finger

-----Original Message-----
From: James Pujals [mailto:james.pujals () sterlingpayment com] 
Sent: 05 July 2006 15:59
To: Tim
Cc: Andrew van der Stock; Webappsec Mail List
Subject: RE: Two-Factor Authentication on the Web


> > "How could your DNA (I would waver on this one
since I heard somewhere that twins could have the same DNA),
fingerprint, retinal scan, etc, not be unique to you and only you? Nor
am I buying the movie version of someone getting their finger cut off by
a thief for accessing their bank account or maybe I am misunderstanding
what you are trying to say."
 
I see I didn't explain myself properly.  My DNA, fingerprint, or retinal
scan is perfectly useless for authentication unless there is a "known"
baseline copy stored by the authenticating system to compare it to.
That means that my DNA, fingerprint, or retinal scan does not prove who
*I am* as an individual, but it proves that I am whomever your system
associates with its stored credentials, be it a specific customer,
citizen, employee, or pet.  This makes the security of the registration
process a highly critical point for the integrity of the system.  And
since part of the topic at hand is remote enrollment for online web
applications, this dependence on the "infallibility" of biometrics is
dangerous.
 
 
      -dZ.
 
 
 
________________________________

From: Tim [mailto:pand0ra.usa () gmail com]
Sent: Fri 06/30/2006 20:04
To: James Pujals
Cc: Andrew van der Stock; Webappsec Mail List
Subject: Re: Two-Factor Authentication on the Web



The 3 factors of authentication are:
Something you have (i.e. a token, card, etc)
Something you know (i.e. a password)
or
Something you are (i.e. a fingerprint, DNA, etc)

"But even when biometric authentication "works", it still does not prove
my _identity_, it just proves that I am who *I said* I am, which is
another thing entirely;" Umm... I don't follow. How could your DNA (I
would waver on this one since I heard somewhere that twins could have
the same DNA), fingerprint, retinal scan, etc, not be unique to you and
only you? Nor am I buying the movie version of someone getting their
finger cut off by a thief for accessing their bank account or maybe I am
misunderstanding what you are trying to say. Currently, with ID theft
you don't see bad guys walking up to people on the street, point a gun
at them and demand their SSN, or credit cards do you?

Based on history, the tendency is to subvert the technology, not attack
people (in regards to personal information). Also, from what some
vendors have told me is that the technology requires blood pressure in
order to work correctly (but I have read that it can be subverted by
silly putty). Remember I am not saying that the technology is perfect, I
am saying the concept of biometrics is what can valdate someones
identity because it is something of us.

On 6/30/06, James Pujals <james.pujals () sterlingpayment com> wrote:
> Hello:
>    But even when biometric authentication "works", it still does not 
> prove my _identity_, it just proves that I am who *I said* I am, which

> is another thing entirely; and some might say is its most obvious 
> point of failure.  What's worse, as opposed to other 2-factor 
> authentication methods (e.g. something I have, something I know), the 
> "something I have" with biometrics, or as you say the "something I am"

> is not easily or practically replaceable if by chance it gets 
> subverted.  And thus, given its inherent value and importance to its 
> owner (I'm pretty sure we all want to keep all our fingers, eyes, 
> etc.), the more value placed on the payload it guards (i.e. bank 
> account, medical records, credit history, etc.), the higher the risk 
> increases for its owner; as not only can someone clean up your savings

> account, but they will necessarily have to kill, maim, or otherwise 
> molest of you in the process.
>
>        -dZ.
>
> ________________________________
>
> From: Tim [mailto:pand0ra.usa () gmail com]
> Sent: Fri 06/30/2006 11:45
> To: Andrew van der Stock
> Cc: Webappsec Mail List
> Subject: Re: Two-Factor Authentication on the Web
>
>
>
> What I was trying to say is that you can only authenticate someone 
> through biometrics because it is something that they are. I do not 
> dispute that technology can be subverted or that people can be 
> manipulated. What I am trying to say is that a label (name, ssn) 
> cannot be trusted, especially nowadays. I feel the same in that 
> regristration would have to be done in person but again that is 
> impractical. Again, I am not saying that the current biometrics 
> technology is an adequate solution. Just that the concept of 
> biometrics is the only way to validate someone's identity.
>
> You seem to be very familiar with biometrics, can you provide some 
> examples of products that you have experience with that you would 
> consider to be a scam and what ones (regardless of expense) are 
> adequate?



------------------------------------------------------------------------
-
Sponsored by: Watchfire

Securing a web application goes far beyond testing the application using

manual processes, or by using automated systems and tools. Watchfire's 
"Web Application Security: Automated Scanning or Manual Penetration 
Testing?" whitepaper examines a few vulnerability detection methods - 
specifically comparing and contrasting manual penetration testing with 
automated scanning tools. Download it today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm
------------------------------------------------------------------------
--
This e-mail is intended for the named recipient(s).  It and any attachments may contain privileged and/or confidential 
information. They may not be disclosed to or used by or copied in any way by anyone other than the intended recipient.  
If you are not one of the intended recipients, or this email is received in error, please immediately either notify the 
sender or contact OAG Worldwide Limited on +44 (0) 1582 600111 quoting the name of the sender and the email address to 
which it has been sent and then delete it and any attachment(s). 
While all reasonable efforts are made to safeguard inbound and outbound e-mails, OAG Worldwide Limited and its 
affiliate companies cannot guarantee that attachments do not contain any viruses or are compatible with your systems, 
and does not accept liability in respect of viruses or computer problems experienced. Neither OAG Worldwide Limited nor 
the sender accepts any responsibility for viruses and it is your responsibility to scan or otherwise check this email 
and any attachments.  
OAG Worldwide Limited may monitor or record outgoing and incoming e-mail to secure effective system operation and for 
other lawful purposes.  By replying to this email you give your consent to such monitoring. 
Thank you.
OAG Worldwide Limited is a company registered in England and Wales (registered number 4226716), with its registered 
office at Church Street, Dunstable, Bedfordshire, LU5 4HB, United Kingdom.


-------------------------------------------------------------------------
Sponsored by: Watchfire

Securing a web application goes far beyond testing the application using
manual processes, or by using automated systems and tools. Watchfire's
"Web Application Security: Automated Scanning or Manual Penetration
Testing?" whitepaper examines a few vulnerability detection methods -
specifically comparing and contrasting manual penetration testing with
automated scanning tools. Download it today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm
--------------------------------------------------------------------------