Secondary Devices A Minor Chink in the 2FA Security Armor?

Am I missing something, or are secondary devices (e.g. tablets) a bit of a 2FA weakness? E.g., if I know your phone PIN, it might still be very hard to get hold of your phone to leverage it for 2FA. But if you have a tablet that doesn't get daily use, that could be much easier to get hold of unnoticed. It's still low-percentage for most people, of course.

Frequent Password Reset Requirements

For a while, conventional wisdom was that making users change passwords frequently was an anti-pattern—encourages users to choose simple passwords. But with the risk of data being moved offline and brute-forced, has that changed? If the password is used on multiple sites, all it takes is for one careless site to have their encrypted passwords stolen, for offline cracking.

Of course, unique, complex, randomly-generated passwords from password managers such as 1Password are better still.

Remote Car Hacking

There are a lot of articles about the vulnerability of cars to remote car hacking. I continue to think that it should not be possible to update car control software over a wireless connection. Period. Physical access needed to update.

That's not a panacea, but it seems like it would eliminate a lot of the problem. Also, the article talked about passengers hacking driverless cars via the ODB2 port, and exiting the car. Partial physical solution there is to lock the ODB2 port--maybe under the hood. Of course securing the software is the more complete solution.

Two-Factor Authentication

Bruce Schneier, for whom I have massive respect, said 10 years ago two-factor authentication is useless for consumer internet (another post more technical, along the same lines).

I think I understand some of what they are saying--it is not a panacea, and probably will do little to deter mass thefts. But it seems to me like it is an important defense against targeted thefts:

• Targeted doxing, as happened to the CIA director, where someone who  is your personal enemy wants access to your email to embarass you.

• Acquaintance-theft. Where someone you know gets your password (watching you type it at work, etc) and wants to access your accounts. This would include domestic incidents.

• Public or shared-computer theft, via the dreaded keystroke-logger.

The second case is particularly important for financial fraud. At least if you are part of a mass-hack, you have some post-facto protection. If you are a one-off, there is a far heavier burden of proof.


.

Does Voice Password Offer Unique Advantages for BIometrics?

Biometrics such as fingerprint recognition, retina recognition, voiceprint seem like appealing alternatives to the time-tested password. But one big drawback--if biometric data is compromised, as Slate says, "You Can't Change Your Fingerprints". 

But is voice different? Because a voiceprint is inherently sort of like a two-factor approach: a thing you know (your passphrase) and a thing you have (your voice). If your voiceprint is compromised, then you can just use your same voice, with a new passphrase, to create a new voiceprint. Like creating a new password.

This website seems to support my reasoning.

(Obviously no security technology is perfect. Speaking out loud has privacy implications that swiping a finger does not. Supposedly impersonation or pre-recording is not a problem, though.)

Internet of Things: Security for Cars (and other critical stuff)

Security is a major concern regarding the internet of things. If your car's software can be updated remotely, what kind of risks does that create for malicious tampering? Or to take a less dire example, if your thermostat can be set remotely, what if a hacker tries to alter your setting? I have a couple of thoughts on safeguards. 

For less acute risks, such as the thermostat, every device should have a physical disconnect switch. So the person with physical control of the device, can instantly, indefinitely disconnect it from the internet. For more serious risks, such as autos, the ability to perform a remote update needs to be controlled. No wireless--software updates should only be installable via a physical port.

Could App.net have been a better OAuth Authenticator?

App.net started as a paid, no-advertising Twitter clone. I know it grew to be more, stuff that I didn't really follow. I wonder if it could have been a much better OAuth Authenticator?

Reasons not to Login with Facebook, Twitter, etc

In the past few years, it has become common for web sites to allow users to create accounts by simply using their Facebook, Twitter or Google logins. I recoiled in horror the first time I saw it, and I thought it was a one-off hack. But then it became ever-more prevalent, and I slowly realized it was sanctioned.

I finally got around to investing about 2 hours of my life in better understanding this. It is part of a standard called OAuth (open authorization). It's interesting, powerful and convenient. But based on my research, I conclude my initial reaction is still valid. OAuth, as I understand it, has some substantial drawbacks (note--for convenience, the examples below refer to "Facebook", but it would be the same for any of the social sites that support the OAuth login buttons):

#1: The most severe is impersonation. When you use OAuth for authentication to, say, the sleaze.com website, sleaze.com retains a token, giving it the indefinite ability to impersonate you, at other sites! (I wonder if this is behind the bouts of bot-generated friend-spam I get periodically.) 

#2: The website or app using Facebook login can, as part of the login request, bundle a request for authorizations to Facebook resources. E.g., "allow this app to post on your behalf" or "allow this app access to your address book". Of course the user has the opportunity to decline, and thereby cancel the login process, but they can't selectively decline the authorization requests. It is all-or-nothing. (Looks like that might be changing, at least at Facebook.)

#3: This creates one more avenue for Facebook to collect data about you. The last thing any of us need.

#4: It is a single point of failure. If for whatever reason, you get locked out of your Facebook account, you are locked out of all your other accounts, too. This could happen by your own mistakes, by Facebook's technical problems. It could also be a vector of attack from someone out to annoy you (try to login in as you to get your account locked).

There is a work-around that mitigates #2 and #3: create a special, fake Facebook account, solely for logins. But #1 and #4 are still problems, so I really don't think this is good enough.

Here is an excellent article on the topic, which pretty much says everything I did, but in far more detail.

Google should promulgate secure email

PKI, the whole deal. Good way to draw non-Gmail-users into the fold, too. Way overdue for someone to make this happen.

Stay Signed In - NEVER!

Remember in the early days of 802.11 home wireless, how the out-of-box option was no security? Then, finally, the industry came around and made the default behavior the safe behavior--security on? Well websites really, really need to do the same thing. I hate the "stay signed in" option defaulting to yes. Bad for the innocents, and even dangerous for the paranoid--I have overlooked it once or twice.

Bills that ask for CC Security Code

The CVV2 code is that little 3-digit code you usually have to provide when ordering stuff online. The PCI security rules prohibit storing it, which is a good security feature.

Lately, I have been getting some bills that can be paid by credit card, mainly from healthcare providers, that ask for the CVV2 code. While my reading of the regs indicates that this is not an actual violation (they are forbidden from storing the CVV2 once the individual transaction is authorized and completed), it still seems like a bad idea to have it written down. So I never provide it. I've never had the billing party object.

Credit Cards and Traveling

How annoying. I've noticed in recent years that I get more "fraud detection" messages left on my home answering machine, when traveling and using credit cards. And I know when traveling overseas, you need to give your credit card issuer a heads-up. But during our recent vacation to the Florida Keys, our cards were flat-out denied. Not because of a big purchase, or lots of use, but the very first time we tried, for $40 in groceries.

Such a minor pain to call and get it authorized. And, for Wells Fargo at least, no way to do that on the web. Dumb.

Verified by Visa Is Evil

Just spent 30 minutes trying to buy an airline ticket on Delta. In the final stages of the transaction, I got thrown into a "Verified by Visa" screen. It looks, for all the world, like a moderately sophisticated, man-in-the-middle phising attack. I had encountered it a few times before, but not recently, and those times I was able to click past it. This time I couldn't get past it to save my life. So I aborted and purchased through Travelocity. Did I mention that in addition to consuming 30 minutes of my life, all-told, it also delayed my purchase and the price increased by $50?

I got motivated to do some research. This is a very good blog post, and here are some comments from Bruce Schneier. It sounds like: A) A disadvantage to the consumer; B) Almost inconceivably bad security practices. Nice going, Visa, Banks and Merchants.

Cluetrain Time, Wells Fargo

My wife, Beth, is traveling home to upstate NY. She does that every year so. She used her ATM card a couple of days ago, and took out the maximum $200. Taking out the max was probably a mistake. When she tried to use her card again today, it was denied by Well Fargo (with no clear explanation, of course).

Now I just got an automated fraud-prevention call from Wells Fargo. I thought, okay, that's cool, I'll accept the call, they will put on a fraud-prevention CSR, I'll confirm my wife is traveling in the Albany area, and all will be well. An ounce of prevention, etc. Silly me.

No human agent, just a series of prompts. They wanted me to confirm, IVR-style, each of 5 real or attempted transactions. I would have been on the phone for at least 5 minutes. No thanks, click.

To me, this is another case of "more security is actually less security" (like mis-guided strict password requirements). A much better approach would have been one question:

Have you or an authorized party been traveling in the Albany area, and used or tried to use your ATM card? If not, please press 2 and you will be connected to a fraud prevention specialist. Otherwise, press 1 for yes, to conclude this call.

Securosis Blog

Securosis is a info tech security consultancy, who have this great blog where they publish most of their research. I have found it tremendously helpful for a project I am working on.(I also think "Securosis" is a great name--I assume it is meant to convey "obsessed with IT security, to the point of neurosis".)

Identify Theft

Bruce Schneier (who is by no means a Pollyanna bout security matters) says:

Identity Theft Over-Reported

I'm glad to see that someone wrote this article. For a long time now, I've been saying that the rate of identity theft has been grossly overestimated: too many things are counted as identity theft that are just traditional fraud. Here's some interesting data to back that claim up:

Multiple surveys have found that around 20 percent of Americans say they have been beset by identity theft. But what exactly is identity theft? The Identity Theft and Assumption Deterrence Act of 1998 defines it as the illegal use of someone's "means of identification" — including a credit card. So if you lose your card and someone else uses it to buy a candy bar, technically you have been the victim of identity theft. Of course misuse of lost, stolen or surreptitiously copied credit cards is a serious matter. But it shouldn't force anyone to hide in a cave. Federal law caps our personal liability at $50, and even that amount is often waived. That's why surveys have found that about two-thirds of people classified as identity theft victims end up paying nothing out of their own pockets.

The more pernicious versions of identity theft, in which fraudsters use someone else's name to open lines of credit or obtain government documents, are much rarer.

Web Sites that Use Facebook, Google, etc for Identity

It can be convenient and powerful to log in to a website (e.g., to add comments) using your Facebook (or, occasionally, Google) identity. Convenient, because you don't have to sign up for anything. Powerful, because if you want it to--a big if--it is connected with your identity. It makes me nervous though.

In theory, they are connecting directly to Facebook, through a secure HTTP connection, so they never intercept your password. I see several possible problems, though:

1. A rogue site could fake the Facebook login page, and intercept your password. Maybe they could even do this very cleverly, calling through to Facebook, so that you even get the expected results of a successful Facebook connection.
2. A rouge site could just play on the fact that people are used to doing this, and not even offer a Facebook login page, allowing them to easily capture your password.
3. The Facebook login page could be presented over a non-secure HTTP connection. Unless I am missing something, that seems to be what is happening in the screenshot below, from the site hothardware.com. This probably is carelessness, not an intentional attempt to steal your password. (Am I missing something?--I don't see an "httpS", and I don't see a little lock symbol in the lower right corner.

Lesson from the Climate Email Hack

Why isn't email encryption more common? I suppose in that case the email was probably stolen from the server, so soft-core encryption (encrypting the email when transmitted outside the trusted domain) wouldn't have prevented it. That would have required hard-core encryption--where the message is only decrypted on the client computer, viewing the email. And most people think of soft-core encryption when they think of email encryption. Still, it is surprising to me that it hasn't taken hold, at all.

LinkedIn Offers Backdoor to Derive Someone's Email Address

Normally in LinkedIn, you can't see someone's email address if they are not linked to you. If you want to send them an invite, you can do that, but it goes through LinkedIn--the process does not expose their email address.

However, if you send an Invite to someone, and they have their Out of Office (OOO) reminder set, you will get an OOO from them, which gives you their email address. This is a little bit of a security gap, probalby not a huge on, but someone, somewhere, will exploit this in some say.

This problem arises from the interaction of LinkedIn with the OOO reminder (typically set in Microsoft Outlook).  Interestingly, a solution could be obtained if either piece of software were more security-conscious. LinkedIn could send the invitation request email without providing the Inviter's email address. That way, when OOO auto-generated a reply, it would not go to the sender of the invitation--it would go into a no-reply address at LinkedIn. And OOO should definitely be masking the "Reply To" address; not just for this reason, but in general.

Viacom/YouTube Privacy Problem: Another Reason to Use Anonymous Browsing

In all the words I have read about the Viacom suit against YouTube, the possibility of anonymous browsing to remove the problem of preserving one's privacy has been thoroughly overlooked.