Subject: Re: [perpass] Stopping password sniffing

From: "Joe St Sauver" <[email-masked]>
Date: Tue, 12 Nov 2013 09:32:34 -0800 (PST)

Hi,

Watson commented:

#Passwords are fine provided they are not reused, and transmitted over
#secure channels.

Has that really been everyone's experience? From my POV, passwords
really seem to be inherently badly broken:

-- if the user's system is botted, single channel authentication systems
   (including passwords) are toast out of the box; you really need a 
   second channel, such as auth confirmation via a user's smart phone

-- unless we get broad adoption of federated authentication, we'll always
   have *too many* usernames and passwords (and solutions like Shibboleth
   tend to treat mobile apps and non-web scenarios as an after thought)

-- if you care about formal NIST SP800-63-1 style assurance, implementing 
   throttling as required at section 8.2.3 can be tricky: "the Verifier
   shall effectively limit online Attackers to 100 failed attempts on a
   single account in any 30 day period." [I should probably clarify that 
   this is "tricky" *IF* you care about avoiding denial of service 
   attack scenarios]

-- and the list goes on...

#Client certificates are already supported and widely deployed. The DOD
#uses them on smartcards for just about everything. The big problem is 
#a UI issue.

I think the problems with client certs goes far beyond just issues with
the user interface. 

While the CAC/PIV cards you mention are a nice existence proof that client 
cert PKI is "possible," I invite you to review https://militarycac.com/ for 
a practical indication of where CAC/PIV implementation is at. There are an
awful lot of arcane workarounds and exception cases, and trying to use
CAC/PIV cards on alternative operating systems is particularly tricky.

On a scale of 1 to 100, where 100 is "perfect, painless, just works" and 
1 is "totally broken, unusable," there are many scenarios where CAC/PIV
cards are closer to the bottom of the thermometer than the top.

If you truly believe that client certs are the answer, I invite those with
that belief to begin using client certs with S/MIME to routinely sign
all their email. I've got a document that walks you through the process of 
using client certs that I put together for the Educause/Internet2 
Security Professionals Preconference Seminars, and it walks you through 
the process. If you want to try it, see
http://pages.uoregon.edu/joe/secprof2012/sec-prof-2012-client-certs.pdf

I'd also note that if you really care about the security of your client
certificate credentials, and you want a public/private keypair that was
created on a PKI hard token or smart card in non-exportable form, that's 
great, but it poses some issues if you want to use those credentials on 
mobile devices (such as smart phones or tablets). Yes, there are things 
like "CAC sleds" for some mobile devices, but they aren't cheap, which
means that this is NOT a ready-for-mass-market solution as it currently 
stands.

Regards,

Joe

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 12 Nov 2013 10:34:52 -0800

> really seem to be inherently badly broken:

What is written is strictly accurate but misses the point that real users
cannot and will not remember a different password for every site.

I share the same password across all my low security sites and have no
intention to change that. It is not worth my time to remember a different
password to log into the Washington Post or the NYT or whatever.

I am not going to use my brain cells to protect someone else's asset. Nope,
not unless they are paying me to do so. All my Facebook accounts use the
same password which is the same as my Twitter accounts and all the other
social media accounts. Remembering my usernames is hard enough.

When I am forced to change my password it takes me several months to get
back to steady state which is only achieved when all the sites have the
same password again.

>    this is "tricky" *IF* you care about avoiding denial of service

I frequently rack up a dozen tries because I can't remember the
username/password combination.

> I think the problems with client certs goes far beyond just issues with

The main problem is that they expire. And the second problem is that none
of the infrastructure expects one user to have multiple certs. So the cert
has to be shared across devices which negates the security advantage.

> cert PKI is "possible," I invite you to review https://militarycac.com/for

The user experience is designed for checklist compliance. It isn't very
good. People can be paid to use it but it really only works in closed
enterprise environments right now.

-- 
Website: http://hallambaker.com/

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 15 Nov 2013 15:55:25 +0100

On Tue, Nov 12, 2013 at 09:32:34AM -0800,
 Joe St Sauver <[email-masked]> wrote 
 a message of 68 lines which said:

> -- unless we get broad adoption of federated authentication, we'll
>    always have *too many* usernames and passwords

This problem has been solved a long time ago, by password
managers. Every Web browser have a pretty good one these days and, if
you don't like them (or for other uses than the Web), there are many
good password managers, under many licences, for many platforms.

---

From: Leo Vegoda <[email-masked]>
Date: Fri, 15 Nov 2013 07:02:31 -0800

> good password managers, under many licences, for many platforms.

Yes, the problem is that the overwhelming majority of users don't see a
reason to have different or complex passwords. The problem isn't a lack of
good solutions.

---

From: Tim Bray <[email-masked]>
Date: Fri, 15 Nov 2013 07:04:54 -0800

I've had very poor success in getting non-geek civilians to use password
managers.
On Nov 15, 2013 6:56 AM, "Stephane Bortzmeyer" <[email-masked]> wrote:

> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass
>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 15 Nov 2013 16:11:48 +0100

On Fri, Nov 15, 2013 at 07:04:54AM -0800,
 Tim Bray <[email-masked]> wrote 
 a message of 56 lines which said:

> I've had very poor success in getting non-geek civilians to use
> password managers.

And in getting them to use Shibboleth or smartcards or other fancy
passwordless systems? :-)

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 15 Nov 2013 10:57:47 -0500

> good password managers, under many licences, for many platforms.

You are confusing an optional proprietary extension that is supported on
some systems for a solution.

Most of us are forced to use more than one browser and those of us who like
one particular browser do not want to be locked into one password manager.
And none of the password managers out there is particularly good because
there are many sites that actively try to prevent password storage,
especially those that really aren't a security issue for users.

None of them work well enough to let the service choose a strong password
for me (i.e. 128 bit).

What we need here is a standardized mechanism for storing passwords to meet
the needs of users that also provides a strong authentication mechanism
that meets the needs of the sites.

Unfortunately we are back in the competitive stage of the browser war where
all the players are trying to protect their position by raising the
switching costs on their platform.