Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Apple, Amazon Security Fails: Time For Change
Newest First  |  Oldest First  |  Threaded View
MarkSitkowski
50%
50%
MarkSitkowski,
User Rank: Moderator
9/5/2012 | 12:46:36 AM
re: Apple, Amazon Security Fails: Time For Change
Whenever I read one of these cautionary tales, I wonder how long it will be before organisations realise that passwords, PIN codes, biometrics and eyeball scans are not the answer. As Andrew rightly says, if it's difficult, people won't use it. I personally, have a directory on my machine containing about 80 files, with the username and password for every online connection I make - and I'm in the security business.
Security hole? Definitely. Avoidable? Definitely.
How much easier it would be, if all I had to remember was just one key word, of arbitrary length and, when I had to login to something, I was presented with an alphabet, and a string of corresponding random zero's and one's. All I'd have to do, is enter the numbers matching my word, and nobody, unless they read my mind, would know what my word was. If they tried copying what I'd typed, it wouldn't match the second set of random numbers. A nine-year old could do use it.
Oh, yes. When I entered my key word for the first time, or decided to change it, perhaps I could be presented with a random array of jpeg's of letters, which I could drag and drop into a field, so that malware didn't know what my new word was. That would be easier than typing, and a nine-year old could manage that, too. Perhaps there already is such an authentication system and, perhaps, a couple of banks, cloud providers and law-enforcement agencies are already implementing it. Perhaps it's described in a document at www.designsim.com.au/What_is_S....
Mathew
50%
50%
Mathew,
User Rank: Apprentice
8/17/2012 | 9:59:56 AM
re: Apple, Amazon Security Fails: Time For Change
Great comment, Anon. Reminds me of Norman Mailer's "Harlot's Ghost," in which one of the characters is trained in spycraft techniques which (if memory serves) involve applying arbitrary colors and object names to help memorize important words or concepts.
But the problem word in that statement is training--teaching yourself how to do this, then remembering what your system is.
So here's a suggestion: For those of us not so well-versed in such systems (myself included), use password safe software that works across PC/Mac, tablets, and smartphones. If you're using such software to keep track of unique passwords for every website you use--which you should be doing anyway--there's ample room to also track just which unique "mother's maiden name" you've used for any given website.
-- Mathew Schwartz
ANON1237925156805
50%
50%
ANON1237925156805,
User Rank: Apprentice
8/16/2012 | 5:15:34 PM
re: Apple, Amazon Security Fails: Time For Change
No security question need be a problem because YOU DON'T HAVE TO GIVE THE RIGHT ANSWER!!! This info does not get verified. You are asked for a fact about yourself to minimize the risk of your forgetting the answer to the security question.

I began my "lying" strategy when banks would ask for my mother's maiden name so that they could verify my identity if I later needed to bank by phone. This was years before the internet.

When asked for my mother's maiden name I give a syllable from the middle that's a very obscure but charming word. No one else would think of it, but I now remember it right alongside her actual name.

The trick is to develop one fake answer for each of the researchable standard questions as it comes up. Once you've got it, always give that answer for that question. Make your fake answer relate to the question with an association that's strong for you. That way it'll be just as easy for you to remember as the correct answer.

For example, would-be predators can look up your city of birth but they can't guess or research if you give another city instead. I give the city and state where my parents lived at that time and where I lived for the first seven months of my life.

If asked for my grandmother's first name, I give the name of her favorite sister, first and married names. If asked for my high school, I give one of the school's cross streets. Etc., etc.

This strategy works very well even for technophobes; each of us has associations that will support our recall of well-crafted bogus answers. Get a small library and you're set. So coach your friends!
Andrew Hornback
50%
50%
Andrew Hornback,
User Rank: Apprentice
8/14/2012 | 2:14:12 AM
re: Apple, Amazon Security Fails: Time For Change
Every time you make things "difficult" for a user to use, the more likely they're not to use it.

But, when you have the simplicity of "Oh look, one click and my entire life gets backed up on the cloud and I never have to worry about it"... that sells people on your solution.

What needs to happen is the ability for users to determine how many levels of security that they want for their accounts. Give a user the option of adding things like call back verification, two factor authentication, etc, etc. instead of applying a "one size fits all" solution across the board. Grandma storing her chicken cacciatore recipes on the cloud doesn't necessarily have the same security level requirements of someone doing on-line bill paying.

Andrew Hornback
InformationWeek Contributor
ANON1243950556912
50%
50%
ANON1243950556912,
User Rank: Apprentice
8/13/2012 | 6:43:59 PM
re: Apple, Amazon Security Fails: Time For Change
My bank allowed me to sign up for online banking with my account number (available to anyone to whom I ever sent a check, or anyone whose check I cashed) and the last four digits of my phone number. Gee, I wonder how you could find out what someone's phone number is.

Typical security questions: "What is your grandfather's first name?" "What was the name of your high school?" and the ever-popular "Mother's maiden name."

But some halfway decent ones: Name of your first pet, favorite movie.


Cybersecurity Industry: It's Time to Stop the Victim Blame Game
Jessica Smith, Senior Vice President, The Crypsis Group,  2/25/2020
5 Ways to Up Your Threat Management Game
Wayne Reynolds, Advisory CISO, Kudelski Security,  2/26/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9447
PUBLISHED: 2020-02-28
The file-upload feature in GwtUpload 1.0.3 allows XSS via a crafted filename.
CVE-2019-10064
PUBLISHED: 2020-02-28
hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.
CVE-2019-8741
PUBLISHED: 2020-02-28
A denial of service issue was addressed with improved input validation.
CVE-2020-9399
PUBLISHED: 2020-02-28
The Avast AV parsing engine allows virus-detection bypass via a crafted ZIP archive. This affects versions before 12 definitions 200114-0 of Antivirus Pro, Antivirus Pro Plus, and Antivirus for Linux.
CVE-2020-9442
PUBLISHED: 2020-02-28
OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by copying a malicious drvstore.dll there.