Comments on Securology: Soft tokens aren't tokens at all

Please note that I was careful to say 'network-bas...

2007-12-13T09:17:00.000-06:00

Please note that I was careful to say 'network-based MITM attacks' :). I think given today's technology, combining mutual authentication with a defense-in-depth approach to malware (on the client and the gateway, basically) is the best you can do as a corporation. I think that is a reasonable trade-off of risk for the benefits of remote access.

The man-in-the-browser is a tough one for financial transactions (and this is very different from the corporate remote access scenario). The use-once rootkit might help. I also think that an out-of-band digital signing mechanism will be necessary in the long run. We've thought about extending our wireless token client to do that, but are really focusing on the corporate vpn market at this time (mostly due to the PCI requirements for two-factor authentication).

If you want some more whitepapers, you can email me at nowen at wikid systems .com. And don't worry, we don't have spamish marketing system.

Hi Nick,Thanks for dropping by.I am not familiar w...

2007-12-12T23:34:00.000-06:00

Hi Nick,

Thanks for dropping by.

I am not familiar with your WikID solution, but I found a WikID Whitepaper Download on Sourceforge, so I'll review it and your code and hopefully post a follow-up on how your solution is better (or not, whichever the case may be ;).

Your second point is dead on: malware is a show stopper. In that case, how can any organization make a trust decision regarding the trustworthiness of a remote user (whether employee, business partner, or customer), since all of the popular OSes upon which these critical software functions reside or so fundamentally flawed-- they all have separation of code and data problems. I think that's what Dan Geer was getting at with his suggestion to rootkit your customers for secure transactions (although I think there are some faulty assumptions in using one-time-use rootkits, such as rootkits trumping rootkits).

Third, I'm not convinced (at least not yet) that mutual auth can guarantee that a transaction is free from MITM attacks. If a MITM sits in the browser (ala browser rootkits) information can be stolen and transactions can be forged ... even with mutually authenticated public key crypto and a reasonably intelligent end-user.

I enjoy the conversation, so let's keep it going!

Greetings. I too have posted a response on my blog...

2007-12-12T09:46:00.000-06:00

Greetings. I too have posted a response on my blog. It just points out that our software tokens use public key encryption and not a symmetric, seed-based system. This pushes the security to the initial validation/registration system where admins can make some choices about trade-offs.

Second, I submit that any device with malware on it that successfully connects to the network is bad. So you're better off saving money on tokens and spending it on anti-malware solutions, perhaps at the gateway, defense-in-depth and all.

Third, I point out that our PC tokens provide https mutual authentication, so if you are confident in your anti-malware systems, and are concerned about MITM attacks at the network, which are increasingly likely for a number of reasons, you should consider https mutual auth in your two-factor thinking.

Here's the whole thing:
On the security of software tokens for two-factor authentication
and thanks for stimulating some conversation!

Hi, Great piece! I wanted to let you know that RSA...

2007-12-11T17:51:00.000-06:00

Hi,

Great piece! I wanted to let you know that RSA's Sean Kline has published a response to this blog.

Sean's blog entry