What I was trying to say is that you can only authenticate someone
through biometrics because it is something that they are. I do not
dispute that technology can be subverted or that people can be
manipulated. What I am trying to say is that a label (name, ssn)
cannot be trusted, especially nowadays. I feel the same in that
regristration would have to be done in person but again that is
impractical. Again, I am not saying that the current biometrics
technology is an adequate solution. Just that the concept of
biometrics is the only way to validate someone's identity.

You seem to be very familiar with biometrics, can you provide some
examples of products that you have experience with that you would
consider to be a scam and what ones (regardless of expense) are
adequate?

6/30/06, Andrew van der Stock <vanderaj (AT) greebo (DOT) netwrote:

30/06/2006, at 4:03 PM, Tim wrote:

the only way I see that you can accurately validate
someone would be through biometrics (something you are)

This is not possible, as:

All devices in general are tamperable and not trustworthy when in the
hands of the attacker

Biometric devices have a long history of being little more than snake
oil or toys. The good ones are significantly more expensive than ANY
other form of actual 2FA authentication device

Many attacks against existing biometric devices are so trivial as to
be a complete joke. Check out this page:

Lastly, trustworthy biometric registration requires an in-person
visit, thus negating any possibility of remote authentication.

No matter what 2FA device you use, evidence of identity is only as
strong as the registration process. I'd prefer to see the initial
registration (and recovery of registration) done only in-person.
the process is open to abuse by definition.

thanks,
Andrew

Sponsored by: Watchfire

As web applications become increasingly complex, tremendous amounts of
sensitive data - personal, medical and financial - are exchanged, and
stored. Consumers expect and demand security for this information. This
whitepaper examines a few vulnerability detection methods - specifically
comparing and contrasting manual penetration testing with automated
scanning tools. Download "Automated Scanning or Manual Penetration
Testing?" today!

30/06/2006, at 4:03 PM, Tim wrote:

the only way I see that you can accurately validate
someone would be through biometrics (something you are)

This is not possible, as:

All devices in general are tamperable and not trustworthy when in the
hands of the attacker

Biometric devices have a long history of being little more than snake
oil or toys. The good ones are significantly more expensive than ANY
other form of actual 2FA authentication device

Many attacks against existing biometric devices are so trivial as to
be a complete joke. Check out this page:

Lastly, trustworthy biometric registration requires an in-person
visit, thus negating any possibility of remote authentication.

No matter what 2FA device you use, evidence of identity is only as
strong as the registration process. I'd prefer to see the initial
registration (and recovery of registration) done only in-person.
the process is open to abuse by definition.

thanks,
Andrew

Hello:
But even when biometric authentication "works", it still does not prove my _identity_, it just proves that I am who *I said* I am, which is another thing entirely; and some might say is its most obvious point of failure. What's worse, as opposed to other 2-factor authentication methods (e.g. something I have, something I know), the "something I have" with biometrics, or as you say the "something I am" is not easily or practically replaceable if by chance it gets subverted. And thus, given its inherent value and importance to its owner (I'm pretty sure we all want to keep all our fingers, eyes, etc.), the more value placed on the payload it guards (i.e. bank account, medical records, credit history, etc.), the higher the risk increases for its owner; as not only can someone clean up your savings account, but they will necessarily have to kill, maim, or otherwise molest of you in the process.

-dZ.

From: Tim [mailto:pand0ra.usa (AT) gmail (DOT) com]
Sent: Fri 06/30/2006 11:45
To: Andrew van der Stock
Cc: Webappsec Mail List
Subject: Re: Two-Factor Authentication on the Web

What I was trying to say is that you can only authenticate someone
through biometrics because it is something that they are. I do not
dispute that technology can be subverted or that people can be
manipulated. What I am trying to say is that a label (name, ssn)
cannot be trusted, especially nowadays. I feel the same in that
regristration would have to be done in person but again that is
impractical. Again, I am not saying that the current biometrics
technology is an adequate solution. Just that the concept of
biometrics is the only way to validate someone's identity.

You seem to be very familiar with biometrics, can you provide some
examples of products that you have experience with that you would
consider to be a scam and what ones (regardless of expense) are
adequate?

Sponsored by: Watchfire

As web applications become increasingly complex, tremendous amounts of
sensitive data - personal, medical and financial - are exchanged, and
stored. Consumers expect and demand security for this information. This
whitepaper examines a few vulnerability detection methods - specifically
comparing and contrasting manual penetration testing with automated
scanning tools. Download "Automated Scanning or Manual Penetration
Testing?" today!

The 3 factors of authentication are:
Something you have (i.e. a token, card, etc)
Something you know (i.e. a password)
or
Something you are (i.e. a fingerprint, DNA, etc)

"But even when biometric authentication "works", it still does not
prove my _identity_, it just proves that I am who *I said* I am, which
is another thing entirely;"
Umm I don't follow. How could your DNA (I would waver on this one
since I heard somewhere that twins could have the same DNA),
fingerprint, retinal scan, etc, not be unique to you and only you? Nor
am I buying the movie version of someone getting their finger cut off
by a thief for accessing their bank account or maybe I am
misunderstanding what you are trying to say. Currently, with ID theft
you don't see bad guys walking up to people on the street, point a gun
at them and demand their SSN, or credit cards do you?

Based on history, the tendency is to subvert the technology, not
attack people (in regards to personal information). Also, from what
some vendors have told me is that the technology requires blood
pressure in order to work correctly (but I have read that it can be
subverted by silly putty). Remember I am not saying that the
technology is perfect, I am saying the concept of biometrics is what
can valdate someones identity because it is something of us.

6/30/06, James Pujals <james.pujals (AT) sterlingpayment (DOT) comwrote:
Hello:
But even when biometric authentication "works", it still does not prove my _identity_, it just proves that I am who *I said* I am, which is another thing entirely; and some might say is its most obvious point of failure. What's worse, as opposed to other 2-factor authentication methods (e.g. something I have, something I know), the "something I have" with biometrics, or as you say the "something I am" is not easily or practically replaceable if by chance it gets subverted. And thus, given its inherent value and importance to its owner (I'm pretty sure we all want to keep all our fingers, eyes, etc.), the more value placed on the payload it guards (i.e. bank account, medical records, credit history, etc.), the higher the risk increases for its owner; as not only can someone clean up your savings account, but they will necessarily have to kill, maim, or otherwise molest of you in the process.

-dZ.

From: Tim [mailto:pand0ra.usa (AT) gmail (DOT) com]
Sent: Fri 06/30/2006 11:45
To: Andrew van der Stock
Cc: Webappsec Mail List
Subject: Re: Two-Factor Authentication on the Web
>
>
>
What I was trying to say is that you can only authenticate someone
through biometrics because it is something that they are. I do not
dispute that technology can be subverted or that people can be
manipulated. What I am trying to say is that a label (name, ssn)
cannot be trusted, especially nowadays. I feel the same in that
regristration would have to be done in person but again that is
impractical. Again, I am not saying that the current biometrics
technology is an adequate solution. Just that the concept of
biometrics is the only way to validate someone's identity.

You seem to be very familiar with biometrics, can you provide some
examples of products that you have experience with that you would
consider to be a scam and what ones (regardless of expense) are
adequate?

Sponsored by: Watchfire

As web applications become increasingly complex, tremendous amounts of
sensitive data - personal, medical and financial - are exchanged, and
stored. Consumers expect and demand security for this information. This
whitepaper examines a few vulnerability detection methods - specifically
comparing and contrasting manual penetration testing with automated
scanning tools. Download "Automated Scanning or Manual Penetration
Testing?" today!

>"How could your DNA (I would waver on this one
since I heard somewhere that twins could have the same DNA),
fingerprint, retinal scan, etc, not be unique to you and only you? Nor
am I buying the movie version of someone getting their finger cut off
by a thief for accessing their bank account or maybe I am
misunderstanding what you are trying to say."

I see I didn't explain myself properly. My DNA, fingerprint, or retinal scan is perfectly useless for authentication unless there is a "known" baseline copy stored by the authenticating system to compare it to. That means that my DNA, fingerprint, or retinal scan does not prove who *I am* as an individual, but it proves that I am whomever your system associates with its stored credentials, be it a specific customer, citizen, employee, or pet. This makes the security of the registration process a highly critical point for the integrity of the system. And since part of the topic at hand is remote enrollment for online web applications, this dependence on the "infallibility" of biometrics is dangerous.

-dZ.

From: Tim [mailto:pand0ra.usa (AT) gmail (DOT) com]
Sent: Fri 06/30/2006 20:04
To: James Pujals
Cc: Andrew van der Stock; Webappsec Mail List
Subject: Re: Two-Factor Authentication on the Web

The 3 factors of authentication are:
Something you have (i.e. a token, card, etc)
Something you know (i.e. a password)
or
Something you are (i.e. a fingerprint, DNA, etc)

"But even when biometric authentication "works", it still does not
prove my _identity_, it just proves that I am who *I said* I am, which
is another thing entirely;"
Umm I don't follow. How could your DNA (I would waver on this one
since I heard somewhere that twins could have the same DNA),
fingerprint, retinal scan, etc, not be unique to you and only you? Nor
am I buying the movie version of someone getting their finger cut off
by a thief for accessing their bank account or maybe I am
misunderstanding what you are trying to say. Currently, with ID theft
you don't see bad guys walking up to people on the street, point a gun
at them and demand their SSN, or credit cards do you?

Based on history, the tendency is to subvert the technology, not
attack people (in regards to personal information). Also, from what
some vendors have told me is that the technology requires blood
pressure in order to work correctly (but I have read that it can be
subverted by silly putty). Remember I am not saying that the
technology is perfect, I am saying the concept of biometrics is what
can valdate someones identity because it is something of us.

6/30/06, James Pujals <james.pujals (AT) sterlingpayment (DOT) comwrote:
Hello:
But even when biometric authentication "works", it still does not prove my _identity_, it just proves that I am who *I said* I am, which is another thing entirely; and some might say is its most obvious point of failure. What's worse, as opposed to other 2-factor authentication methods (e.g. something I have, something I know), the "something I have" with biometrics, or as you say the "something I am" is not easily or practically replaceable if by chance it gets subverted. And thus, given its inherent value and importance to its owner (I'm pretty sure we all want to keep all our fingers, eyes, etc.), the more value placed on the payload it guards (i.e. bank account, medical records, credit history, etc.), the higher the risk increases for its owner; as not only can someone clean up your savings account, but they will necessarily have to kill, maim, or otherwise molest of you in the process.

-dZ.

From: Tim [mailto:pand0ra.usa (AT) gmail (DOT) com]
Sent: Fri 06/30/2006 11:45
To: Andrew van der Stock
Cc: Webappsec Mail List
Subject: Re: Two-Factor Authentication on the Web
>
>
>
What I was trying to say is that you can only authenticate someone
through biometrics because it is something that they are. I do not
dispute that technology can be subverted or that people can be
manipulated. What I am trying to say is that a label (name, ssn)
cannot be trusted, especially nowadays. I feel the same in that
regristration would have to be done in person but again that is
impractical. Again, I am not saying that the current biometrics
technology is an adequate solution. Just that the concept of
biometrics is the only way to validate someone's identity.

You seem to be very familiar with biometrics, can you provide some
examples of products that you have experience with that you would
consider to be a scam and what ones (regardless of expense) are
adequate?

Sponsored by: Watchfire

Securing a web application goes far beyond testing the application using
manual processes, or by using automated systems and tools. Watchfire's
"Web Application Security: Automated Scanning or Manual Penetration
Testing?" whitepaper examines a few vulnerability detection methods -
specifically comparing and contrasting manual penetration testing with
automated scanning tools. Download it today!