Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SQRL - Replacement for usernames and passwords

grc.com

Post reply on HN
Print view View original

111–120 of 138 posts

Re: SQRL - Replacement for usernames and passwords

#111

Post by ubernostrum »

bargl wrote: post #37
dsl wrote: post #24

Earlier quoted context omitted.

An ad hominem attack would be attacking him for unrelated traits, i.e. "we can't trust people with blue eyes!" I believe his history as a snake oil salesman is highly relevant to his current "security" work.

Actually it's still ad hominem. The fact that you completely ignored the original post and instead attacked Steve Gibson, is indicative of an ad hominem attack. If you'd even said, this new idea is ridiculous because QR codes are inherently insecure (which is false) you'd be fine. Sources: http://plover.net/~bonds/adhominem.html I think this example is pretty much what you did. A: "All rodents are mammals, but a weas…

It is never fallacious to point out the historical unreliability of a source. It is doubly never fallacious to point out the unreliability of a source, on a given topic, when discussing a new claim, on that topic, from that source, because that information is relevant to how we approach and evaluate the new claim (i.e., claims from historically-unreliable sources should be subjected to greater initial scrutiny).

Also, you've presented no actual rebuttal of whether Gibson's history is relevant to evaluating his present claims. Rather you've merely stated the name of a logical fallacy. Which is, itself...

http://en.wikipedia.org/wiki/Argument_from_fallacy

Re: SQRL - Replacement for usernames and passwords

#112

Post by eastern »

jessepollak wrote: post #105
victorf wrote: post #90

Earlier quoted context omitted.

That looks awesome. It works everywhere that OAuth does? Can it be used with a password as a 2FA?

Yep, you can find our docs at http://developer.getclef.com . Clef is actually 2FA already because it relies on both possession (the device) and knowledge (the 4-digit PIN that protects the app). We're working right now to (optionally) replace the PIN with finger print scanning, when available. Either way, the knowledge (or biometric) portion is much more about asserting ownership of the device (if it gets lost or sto…

Possession of the device and typing a PIN into the _same_ device does not qualify as 2FA.

It's not 2FA unless information flows between the user and the authenticator through two independent routes. For example, in Twitter's (and others') 2FA, information must flow between Twitter's servers and the user through the Twitter UI as well as through a GSM text message. That's 2FA.

Re: SQRL - Replacement for usernames and passwords

#113

Post by sigkill »

maaku wrote: post #110
Sami_Lehtinen wrote: post #106

Quick + / - analysis: - "But no two visitors will ever have the same ID". - How is that confirmed, generating random 512 bit keys do not guarantee never having same ID. It's just quite unlikely. - SQRL lacks strong web-site identification, that's a bad thing. Domain name isn't strong authentication. I would like to include strong site identity with within the QR-key. (Evil website attack, NS spoofing / MITM) + No sha…

> generating random 512 bit keys do not guarantee never having same ID. It's just quite unlikely. Truly random 512 bit keys will never repeat, ever, under any circumstances. Seriously, they won't.

I'd be careful if I were you. Cryptography and cryptographers are an odd bunch. "Never" literally means never, while in your comment "never" means not in our life times, or a thousand, or billions of years. In case of infinite time, 512-bit RNG'ed numbers have to repeat at some point in time.

You may consider this pedantism, but it's this pedantism and conservativeness that calls AES broken today.

Re: SQRL - Replacement for usernames and passwords

#114

Post by jccalhoun »

dsl wrote: post #18

http://attrition.org/errata/charlatan/steve_gibson/ > Steve Gibson is somewhat of a "fringe" charlatan. In some professional security circles, he is not considered a reputable security professional, rather more of a snake oil salesman peddling third-rate software with bold claims. While many of his claims are a bit outlandish or bold, few, if any, are demonstrably false. However, when asked to speak on security topic…

Gibson is prone to hype and proclaiming that the sky is falling which is why I rarely listen to his show. However, a lot of these are nitpicks where he either gave the wrong meaning of an acronym or oversimplified something while trying to explain it.

Re: SQRL - Replacement for usernames and passwords

#115

Post by Rafert »

habosa wrote: post #57

This looks like a much less polished version of Clef ( https://getclef.com/ ). Clef is a really awesome app and they're already powering this type of integration for a few hundred websites. One of the founders is an HN regular, although I can't remember his username (Jesse, reply if you see this).

That is looking great! I saw something similar called http://www.computingobjects.com/qrauthinfo/ but Cleft is looking much nicer.

Re: SQRL - Replacement for usernames and passwords

#116

Post by jakobe »

eastern wrote: post #112
jessepollak wrote: post #105

Earlier quoted context omitted.

Yep, you can find our docs at http://developer.getclef.com . Clef is actually 2FA already because it relies on both possession (the device) and knowledge (the 4-digit PIN that protects the app). We're working right now to (optionally) replace the PIN with finger print scanning, when available. Either way, the knowledge (or biometric) portion is much more about asserting ownership of the device (if it gets lost or sto…

Possession of the device and typing a PIN into the _same_ device does not qualify as 2FA. It's not 2FA unless information flows between the user and the authenticator through two independent routes. For example, in Twitter's (and others') 2FA, information must flow between Twitter's servers and the user through the Twitter UI as well as through a GSM text message. That's 2FA.

I am pretty sure that possesion of device and typing PIN into the same device qualifies as 2FA. A spy that watches you type your PIN can't log in without your device. At the same time, a thief that steals your device, but doesn't know your PIN, also can't log in. You need both; hence TWO FACTOR AUTHENTICATION.

Re: SQRL - Replacement for usernames and passwords

#117

Post by nly »

gcr wrote: post #98
nly wrote: post #96

I think you can MITM this by presenting legitimate (proxied) ycombinator.com QR codes on e.g. ycombigator.com. The app would still authenticate to the legitimate site and then 'activate' the session, and ycombigator.com could have at it. HTTPS won't help either. The problem is there's no way for the phone app to transfer additional secure session cookies back to your desktop browser, so this has to be the case. Sure,…

This attack can be stopped by referer checking. A site that hosts a QR code should display a warning instead of the QR code if the referer doesn't match.

The malicious site in the middle can download the legit QR server side (e.g. using PHP) and simply spoof the referer, then present it to the visitor. Where will a referer check help?

Re: SQRL - Replacement for usernames and passwords

#118

Post by eastern »

jakobe wrote: post #116
eastern wrote: post #112

Earlier quoted context omitted.

Possession of the device and typing a PIN into the _same_ device does not qualify as 2FA. It's not 2FA unless information flows between the user and the authenticator through two independent routes. For example, in Twitter's (and others') 2FA, information must flow between Twitter's servers and the user through the Twitter UI as well as through a GSM text message. That's 2FA.

I am pretty sure that possesion of device and typing PIN into the same device qualifies as 2FA. A spy that watches you type your PIN can't log in without your device. At the same time, a thief that steals your device, but doesn't know your PIN, also can't log in. You need both; hence TWO FACTOR AUTHENTICATION.

The casual thief case is trivial. Surely, clef's goal includes protection against a somewhat more sophisticated adversary who is targeting you, specifically.

Someone gets some malware on to the phone and gets the run of it. Records the pin, later steals the phone, or is able to replicate the entire device.

This could be guarded against if the pin changed every time and was delivered through an independent channel, which is what 2FA if all about. A complete, undetected compromise of a single device or a single information channel should not be able to defeat 2FA. That doesn't appear to be the case here.

Re: SQRL - Replacement for usernames and passwords

#120

Post by jakobe »

eastern wrote: post #118
jakobe wrote: post #116

Earlier quoted context omitted.

I am pretty sure that possesion of device and typing PIN into the same device qualifies as 2FA. A spy that watches you type your PIN can't log in without your device. At the same time, a thief that steals your device, but doesn't know your PIN, also can't log in. You need both; hence TWO FACTOR AUTHENTICATION.

The casual thief case is trivial. Surely, clef's goal includes protection against a somewhat more sophisticated adversary who is targeting you, specifically. Someone gets some malware on to the phone and gets the run of it. Records the pin, later steals the phone, or is able to replicate the entire device. This could be guarded against if the pin changed every time and was delivered through an independent channel, wh…

But 2FA doesn't protect you from even a single compromised device. If the computer you use to access the service is compromised, an attacker can simply intercept your next login attempt. The only difference is that in the case of CLEF the vulnerable part is your mobile, not your laptop.
Post reply on HN