Testing Commercial 2-Factor Authentication Systems? 56
Fry-kun asks: "I recently became interested in setting up a 2-factor authentication system for my laptop. With that in mind, I bought a fairly inexpensive USB key. Although it seems to work, I can't bring myself to trust it completely: Kensington claims that the system is secure, but there is no independent security lab analysis of the product. In other words, for all I know, there may be a gaping hole in their security setup. Worse yet, there are apparently no reviews of the product, no mention of anyone trying to test it and no hardware hackers tried to make it work in Linux, even though it's been out for over 2 years. How would you go about making sure that a security product does what it claims to?"
why... (Score:3, Informative)
RTFQ (Score:2)
Re:RTFQ (Score:5, Insightful)
In any case if you want to increase the security of what I proposed nothing forbids you from getting TWO usb tokens, create truecrypt volumes on both of them, and then create an overlaid raid-0 striped partition on both of them: in this case an attacker would need to steal BOTH tokens and BOTH passwords to gain access to your files.
Schemes like these make it also very easy to mandatorily have multiple people there to open the files (say, all the directors, etc.). If you do things like RAID-5 you could also make it so that you could still access the information with N-1 USB tokens (in case one is lost).
I do think that these solutions are safer than trusting a random crypto vendor, also this is why I have all my sensitive things (tax returns etc.) strictly on TC volumes.
Re: (Score:1)
The one with the keyfile can just have the file on the disk, or if its one of the "secure" USB drives (JumpDrive Secure for example,) have it on the protected partition. The drive with the keyfile, you can keep locked up in a safe, only pulling it out to insert and unlock the other drive.
Of course, you have a couple decoy keyfiles on both the open and secure partitions so you can tell an adversary that yo
Re: (Score:2)
No, it's not. Just because you have the data on a portable device and the data is fairly big or obscured, doesn't mean it's 2-factor. You are exposing the comple
Re: (Score:2)
Re: (Score:2)
Data has the property that anyone can duplicate it without the owner knowing it was duplicated. You can neither prove that it was not duplicated nor that it was duplicated. A necessary property of 2-factor is having a component that you have to physically own. Data on a USB stick definitely does not meet this criterion.
An important part of 2-factor is that you can prove it's not co
Re: (Score:2)
I think you ought to read up a bit more on what 1-factor, 2-factor, 3-factor etc. mean; from wikipedia for example:
Two-factor authentication (T-FA) (or dual factor authentication) is any authentication protocol that requires two independent ways to establish identity and privileges. This contrasts with traditional password authentication, which requires only one authentication fa
Re: (Score:2)
Exactly, keyword being independent. Splitting one factor doesn't mean the thing is suddenly two-factor.
You can't just implement the concept of "something you have" by storing data on an external device instead of the computer, because the data is not bound to the external storage in any way. Something you have means something you must have.
Re: (Score:2)
exactly, *one* of the two factors is your disk image (split between the USB token and the computer HD), the *other* factor is the passwords that you need to actually mount those disk images via truecrypt (I wasn't assuming the disk image was in clear! or that it would be useable at all unless you have both pieces (since it's interleaved in raid-0))
I don't think you've really understood what I was proposin
Re: (Score:1)
Rather than using RAID, much better to use ssss. Description here [debian-adm...ration.org]. An easy script can read the key files from each usb key inserted and pass the keys to ssss. The output from ssss can then be redirected into luks or whatever encryption/login system you want.
Re: (Score:2)
All the keys would represent the one secret you know. There is no part in it that you have to own. Hence it's not 2-factor.
Re: (Score:2)
Easy (Score:2, Funny)
You don't work for the VA do you?
Mod parent up (Score:2)
Does that mean everyone only needs security that he himself can't break? No, everyone needs security that noone can break.
Re: (Score:2)
I don't agree with implementation, mind you - the company wants me to store that recovery key with them. I'd much rather store it in a safe deposit box. Maybe that's just me, though...
Re: (Score:1)
Testing commercial security (Score:5, Informative)
That being said, OSS had a 2-factor authentication mechanism available years ago. Encrypt your hard drive, save the key to a USB key and enter a passphrase. You'll need to both insert the USB key and type your passphrase for the root disk to get mounted. That's pretty much the entire system locked down.
This article [debian-adm...ration.org] appears to detail that process.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
That's the complaint people make about Debian stable, yes (and it's also the reason that many people love Debian stable). Debian unstable is usually (not always, but usually) quicker to add new stuff than Ubuntu.
But... you can copy the key file?! (Score:2)
Re: (Score:1)
This is why I like smartcards. Even if someone gets the smartcard, copying the private key data off (especially copying it without it being noticed) will require a lot of specialized
Re: (Score:2)
Re: (Score:2)
For serious 2-factor authentication, you're looking at security hardware, not just software. Which, for almost everybody, means trusting the manufacturer, supported by any independent certification that has been done, like NIST's Cryptographic Module Validation Program [nist.gov].
Testing doesn't matter, security is about blame (Score:3, Insightful)
Corporate security is more concerned with blame and 'due diligence' than actual security.
Thus, if CompanyX makes a "secure" product, CorporationY will buy it, and deal with a breach by suing CompanyX.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
> Repair or replacement, as provided under this warranty, is your exclusive remedy. KENSINGTON shall not be liable for any incidental or consequential damages. Implied warranties of merchantability and fitness for a particular purpose on this product are limited in duration to the duration of this warranty.
Translated into plain English this means: we will not even promise that the product does what we say it does, but some evil courts have interpreted this promise to be impl
At CES (Score:2, Funny)
Sorry
Backdoors and disclosure (Score:4, Insightful)
Re: (Score:2)
You don't (Score:5, Interesting)
You are not sure, which is the problem. I will give a nod to Kensington here, though. They are about to make a lot of money because they are serious about security, unlike a lot of other companies that peddle USB devices (Kangaroo, I am looking your way).
While it is commendable you are looking for two-factor authentication, a USB key is not the way to go here. The goal here is to not be able to break your encryption if you are forced or influenced to give up your password. Any system you can set up yourself will be breakable by you unless you take extreme measures. For the sake of argument, we will assume that there are no extreme measures in place, but your encryption can still be cracked by you.
Your best bet here is to go with full disk encryption. For further security, use truecrypt with a file on a CD or USB device as part of the key, as was referenced above.
For further security, encrypt again.
As you can see, this goes on. The weak point is you. If you can break it, you can be forced to break it.
If you want complete deniability, triple encrypt all of you regular data, then quadruple encrypt your sensitive data somewhere else. Use files, passwords, obfuscation, etc.
You will still be better off than most people. Including the government, according to plenty of stolen laptop press reports.
Re: (Score:2)
Security is a vector, not a scalar (Score:2)
Two (or more) factor security sounds good, but is designed for independant control of the factors. A USB flashdrive can be cloned and really can't claim independant control.
You can't evaluate it, and it probably sucks (Score:5, Informative)
I work as a secure systems designer and consultant, and I've had some opportunities to review the security of commercial systems of various sorts. What I've learned is (1) properly evaluating commercial security tools is nearly impossible and (2) much of it is lousy.
The most effective means I've found of evaluating tools is to have a client sitting on a really huge purchase order, so that the vendor will give me access to key security personnel on their design, development and testing teams in order to make the sale. The people in question won't actually answer my detailed questions, in most cases, but I can still get a feel for how they think, and what they consider important. That actually gives me a pretty good idea of how secure the stuff they build is, though it's not as good as actually doing a detailed analysis of the design and implementation. Ideally, I'd like to talk to their people, do a detailed analysis of their designs, perform a cursory review of their implementation and then really, deeply scrutinize their security design and QA processes.
What I've found when I start pushing to talk to the "security guys" is that in surprisingly many cases there are none! Or there was one, but he left. Or there is one everyone thinks is the security guy, but he's really just a developer with a basic understanding of security principles, no time to really focus on security, and no authority to get any security problems he finds fixed.
Note that this is not always true. I've found some companies that do a really good job, but they're definitely in the minority.
Assuming you can't actually force the vendor to let you talk to their security team, the only thing I can suggest is that you start looking at publicly-available information. Some things to look for are:
Re: (Score:2)
Not all USB Tokens are the same (Score:2)
However, it is not the same as a USB key with a SIM card or smart chip, such as from ActivIdentity, Aladdin, VeriSign, among others. First off, these systems are based o
Suppose it does exactly what it says (Score:4, Interesting)
Give it a realistic test. Create a Word document with the file name "Arson Confession" and type out something about how you set fire to an orphanage. Make a few revisions. Run Firefox with an extension that leaks memory, leave it up for a day or two so that it forces everything else to be swapped out. Simulate a crash by doing an End Process on Word from the task manager once.
Then boot from a Linux live CD and do something like "strings
Document names in MRU lists in the registry, temp files, and the swap file might not be covered by the encryption. A file name could be a pretty damaging thing to leak. Consider also that Windows may store the file name as Unicode in some places that wouldn't show on fgrep.
It's good thinking and sound practice to wonder whether the gadget does what it claims, but a huge number of security problems come from threats that were outside what the security designers were thinking about. "Security is like an analogy. It only works up until the point that someone considers an angle or aspect that you haven't previously considered and accounted for." [blogspot.com]
Re: (Score:2)
Use money (Score:2)
If you can buy a crack, it's not secure enough.
If you cannot source a crack, put a $5k bounty on it and use the product while blackhats do the work. Discard product immediately once blackhats come up with a solution. Do pay the blackhats/Mafia - consider the $5k money well spent, and it saves an awful lot of trouble later on.
I ended up going PGP and eToken (Score:2, Informative)
...but... (Score:2)
commercial security products (Score:2)
Look at the source code (Score:2)
get indi (Score:2)
Re: (Score:2)
http://www.getindi.com/index2.html [getindi.com]
with all the details
Re:get indi (requires javescript) (Score:1)
Easy. (Score:2)
Taking Responsibility Here (Score:2)
Yet you bought it anyway. Why are you now complaining, instead of having done some proper research before you put your money down?