How crackers ransack passwords - Sort of...

   I am not trying to make this the password rant blog.  But we just can't go a full week without more news about password problems!

   Last week the excellent tech new site, Ars Technica, did a feature article in which they had first a journalist, then three different password hacking experts, try to decrypt passwords from an encrypted password file.  They were all quite successful... frighteningly so.
   Steve Gibson discussed this for a bit in Security Now episode 406.

   But, I think there were some critical flaws in the test.  And there were also some excellent lessons.

   I'll comment on the article using the sandwich method, starting with what was good...

Twitter 1-and-a-half Factor Authentication

   As you may have read, and hopefully enabled, Twitter added a 2-factor authentication capability last week.

   If you haven't yet turned this on, here's how.  Log in to Twitter; select Settings; select Mobile; add and activate your phone.  Here are the detailed instructions for adding your phone number. To enable 2-factor authentication, select Account, then check the box labeled: Account security Require a verification code when I sign in.

   Here's the good news... as I've discussed in the past, I am a fan of using some kind of 2-factor auth for website authentication.  I also like the use of a smartphone for delivering that one-time-use PIN or code.  While we still have a digital divide in the US, most people do have a cell phone, and most of those have a smartphone.

   But there are some issues.

So Long and Thanks for All the Passwords!

   If you've been following any online news lately you read about the recent Living Social breach.  They reported "unauthorized access" of their systems resulting in a download of customer data including name, email address and encrypted passwords.

   We have heard of many similar instances over the past few years.  I've written about this in previous posts and will be giving a talk at Secure360 in St. Paul, MN in a couple of weeks talking about authentication and passwords.

   In their defense, Living Social did do a couple of things well.  First of all, fortunately, they did store only encrypted passwords.  Unfortunately many organizations don't.  Unfortunately they used an older, weaker encryption algorithm.  And, of course, unfortunately they got breached and had the file downloaded.

So What's the Authentication Answer? - 3 Factors of Fail (part 7 - last!)

   We've been discussing the authentication problem for the better part of two months, and now it's time to wrap things up.  If you've gotten to this post through a link but haven't read the rest of the series, it starts with part 1 here.

   Each of the 3 factors of authentication have serious issues when used individually.  The challenge is that we need to log a person into a system or application in a way that reasonably assures the person is who they say they are and has rights to the system.  And, perhaps most importantly, any method we use has to work well for people!

   So, how do we find a solution?

   The key is to think about the user and the use.

Multi-Factor Fail - 3 Factors of Fail (part 6)

from: brainyquote.com

   In December I was at the NG Security Conference in Austin, TX.  We had a fantastic discussion with a group of key security leaders focusing on this "quote" and how it applies to information security.  I say "quote" because there is some question as to who said this or if anyone actually did!

   As I've been saying throughout this series of posts, it seems that this statement is exactly what we are doing in the world of authentication!  None of the typical factors of authentication have really solved our authentication and access problems, yet we continue to use the same mechanisms over again.