Disrupting the paradigm

Not sure if I am quoting here, but be careful when someone says they are disrupting the paradigm, often when you look beneath the vale you will find an issue. The paradigm is usually there for a reason, cause it works.

I have discussed factorisation of authentication before here, this one will be a little more indepth;


To reiterate authentication currently works under a model of factors. Factors are simply classifications of things, in a cumulative manner. Things could be something you know (and preferably keep private), something you have, something you are, somewhere you are. This is 4 factors.

Something you know; Pin, password, passcode, passphrase, pictures in a certain order, last 4 digits of a credit card (even though this is something you have, it is a known never changing string).

Something you have; a key, a key-card, usb fob, Certificate, smart-card, rfid chip, SMS/Phone call receiving phone, Bluetooth paired phone or other device, laptop, tablet, phone itself.

Something you are; fingerprint, iris scan, voiceprint, DNA sequence.
I will rant on biometrics later, but you can't re-issue a fingerprint so if it gets compromised and copied by someone you are out of luck.

Somewhere you are; GPS location, IP-gelocation (thou as this would be in band checked on the connection you may be using to access the service the security doesn't increase), a landline or mobile phone could also be somewhere you are, eg you login to an app and it calls you on a separate phone at that same location to ensure you meant to.

Lets look at some examples.

• You login to your computer with a username and password, this is 1 factor of authentication, just a password.
• You login to your computer with a username and password, then onto a super-secret corporate system with a different username and password, this is still 1 factor of authentication. You only used a username and password.
• You login to your PC using a swipe card only, this is still 1 factor of authentication.Yes you used something you have, but it was not cumulative on something you know.
• You login to your PC using your username, password and Secure USB key, this is now 2 factors of authentication, something you know and something you have.
• You login to your PC using your username, password, thumbprint and Secure USB key, this is now 3 factors of authentication; something you know, something you have and something you are.
• You login to your netbanking via their app with username, password, fob token code, and your thumbprint on the home button. The app has rights to your phones GPS, it disallows transfers over $1000 from anywhere but inside your own home or registered place of work, if you go to transfer $1001 to another account and it then allows you due to the registered GPS, this could be considered 4 factors of authentication; something you know, have, are, and somewhere you are, all checked to ensure valid authorization.

Now comes the paradigm shifting. I wish it was me that thought of these.

Device profiling
This makes the device a factor, specifically a second factor.
This will do things like take the IP you are logging in from weighted with things like browser headers and put them in a database, if sees these to dramatically change it can deny you access.
A good example shoring the power of this hidden data that you send can be seen at the EFF's Panotoclick here; https://panopticlick.eff.org/
There are certain banking and social media apps that do this already, alerting you via email when you have logged in from a new device.


Risk based authentication
Awesome idea, basically the application has some smarts. Similar to the above device profiling it does some device profiling and then if you fail it, it either challenges you for more authentication or simply denies you access. It has risk scores that it assigns to things, so risk +1 if you are logging in at a different time, risk +9000 if you are logging in from a country with a bad reputation that you have never logged in from before. This still works in the factorising model, but doesn't force a user to enter every-factor every time, it is an extension of the paradigm.

Pingrid and their ilk
As I mentioned last time, these aren't two factor. They are a challenge, with a user response based on something they know. Interestingly I think they do increase security, but still not as much as a second factor. This really doesn't fit the factorised model. See there demo here; https://www.winfrasoftbank.com/MyAccounts/Default.aspx
You can see how due to the randomness of the numbers it does reduce the likelihood that the users "password" will ever be compromised by an over the shoulder or man in the middle attack, but again repeat enough views of the users login through a screen scraper and you have them. Still doesn't stop Man in the browser attacks (where malicious code waits for you to authenticate to your bank then distracts you and gives control of that tab to the remote bad guys to transfer out your cash).

That being said, I think they are probably making the authentication process more complicated than it needs to be and not more secure. Hard tokens that are transparent to the user like Ubi-key or smart cards are much, much more secure.

So uhh disrupting the paradigm, I thought I could make case that the above three did disrupt the paradigm, but they don't. I started this article all gung-ho to prove to myself they did, but they simply extend what we already have.
Device profiling and risk based authentication either work with existing factors of authentication, or make a sting of numbers unique to you and your device part of auth (just like a certificate or token, and thus are a second factor), and pingrid is simply an extension of single factor authentication.

Seeing as I mentioned Schneier last time I posted about auth, I had a look to see is he has discussed pingrid or others, he hasn't. But I did find the below, which is awesome;
http://www.schneierfacts.com/fact/vote/631