21–30 of 56 posts
statements like this make me very very nervous as AES by itself is basically useless and the impotent part being how they use AES.
I'm intrigued! But a few questions/comments: * How is this two-factor? I only see one factor (a thing you have, your phone). Email adresses are not secret. * Again, email adresses are not secret. How do you limit login-spamming? I don't want to wake up in the middle of the night because someone is trying to break into my account. * What about timing attacks? If i stand over your shoulder while you're in the library -…
> Basically, this is an extremely secure, 2 form factor, idiot proof login system As far as I know, factors are 1. Something you know (password) 2. Something you have (a dongle or phone) 3. Something you are (iris or fingerprint) With only pressing a button on a phone, how can this be two-factor? There is no password ("passwords are obsolete" and usernames are not a knowledge factor in multi auth) and nothing of biom…
I'm intrigued! But a few questions/comments: * How is this two-factor? I only see one factor (a thing you have, your phone). Email adresses are not secret. * Again, email adresses are not secret. How do you limit login-spamming? I don't want to wake up in the middle of the night because someone is trying to break into my account. * What about timing attacks? If i stand over your shoulder while you're in the library -…
I have a question too. How do you avoid being spammed by someone creating a new account with your email or sending "forgot password" over and over?
This method isn't secure unless both the website and phone display a code (e.g. a short hash over a Diffie-Hellman, or other, shared secret and the session id) so you can determine which session you're authenticating. Otherwise, anyone who can determine that you're logging in (traffic analysis is possible even if it's encrypted) can initiate a timing attack. I've also only glanced over the API docs, but it looks like…
In relation to the phone, users may pin-protect (for now, we're looking into additional methods) each individual profile. The main difference is that the user no longer uses the same communication channel (browser-server) to send the full set of credentials, with UNLOQ, a separate channel is used (device-UNLOQ paired connection)
Earlier quoted context omitted.
I have a question too. How do you avoid being spammed by someone creating a new account with your email or sending "forgot password" over and over?
Good point, you don't. But on the other hand, filtering out an email you don't want is easy (in most email clients), so you won't get a notification each time. I'm assuming this app has no filtering, so if someone wanted to DOS me with this, they could - there's no way i could (or would) handle a ton of login requests per second to try to find the login request i initiated. You can't DOS someone with account signups…
This method isn't secure unless both the website and phone display a code (e.g. a short hash over a Diffie-Hellman, or other, shared secret and the session id) so you can determine which session you're authenticating. Otherwise, anyone who can determine that you're logging in (traffic analysis is possible even if it's encrypted) can initiate a timing attack. I've also only glanced over the API docs, but it looks like…
The system has some built-in rules that prevent timing attacks from happening, so that only one authentication request may be active per user. A few other rules run in the background, preventing other similar attacks. In relation to the communication between the service server and our server, we're currently offering the traditional api key/secret method, but we will roll out RSA-enabled calls. In relation to the pho…
If you do that, enforce TLS/SSL, and display a session code to stop timing attacks (even if you only allow one login at a time, it's still vulnerable to race), then it's not terrible.
Earlier quoted context omitted.
Push notification to your phone. They don't have iOS support yet which counts me out from trying it out.
I have quite a few android devices, but the play store tells me that "This app is incompatible with all of your devices". But I'll keep an eye on this, seems nice. I guess it's two-factor enough, because I have a password on my phone.