Avensys
United Highsec Front
The 99 Percent
84
   |
Posted - 2012.01.12 09:43:00 -
[2] - Quote
Mangua Desnart wrote:Avensys wrote:How do you link the authenticator to your account?
seems to me that this would have to be done over a separate communications channel with credentials that a hacker wouldn't have access to even if he had compromised your PC at the time you want to set up the link.
(paper) mail or fax with a copy of your passport?
otherwise it's mostly security theater. The way SWTOR do it is when you tie the authenticator to your account then you input the code that is on the fob / app at the time of setting it up and then I presume there is some back end magic and trickery that knows what the next numbers will be from that starting point
Deviana Sevidon wrote:There is no magic involved and no communication between authenticator and server. The authenticator has a serial number that is added to the account . If you press the button on your authenticator/mobile phone app, the software generates the authenticator key from the serial number and the time set in the mobile phone. Since the auth. serial number is registered on the account the login servers also knows which authenticator code is currently the correct one. Edit: Here is some additional information about how the process of the two factor authentication works: http://en.wikipedia.org/wiki/Two-factor_authentication
you missed the point of my post.
I'll try an analogy: let's say we decide to write each other encrypted emails for extra security (in a world without asymmetric encryption for argument's sake).
If I send you the encryption key via email, the whole security precaution is moot. I have to send you the key out-of-band (e.g. via paper mail) for the encryption to be useful.
The authenticator app has to be deterministic, it will always produce the same outputs given the same serial number (and time of the day, number of times the button has been pressed, ...).
The algorithm used for this can be reverse-engineered and should not be considered secret.
The real secret is the serial number of your authenticator.
Transmitting this secret via your computer (by entering your authenticator serial number on some website) while you want to protect yourself against someone who might already have access to your computer (e.g. via a keylogger) is extremely stupid. With the logged serial number an attacker could simply clone your authenticator.
For the security measure to be effective the authenticator's serial number has to be transferred out-of-band - which is possible by either linking auth & account before it is sent to you/you download it or by having you transfer the auth serial number via SMS, paper mail, ...
Note that an authenticator application on your PC would be a very bad idea for the same reason - the authenticator's strength is that once set up somebody controlling your PC would not have access to it and would be limited to (hopefully complex) Man in the Middle attacks (e.g. logging the auth code you entered in the application, displaying you a "login failed" notice without passing the auth code to the server, then using the auth code to log in to your account within the next few minutes).
Then there is the problem how to verify that the person linking authenticator and account is really the account holder.
Username and password are not sufficient as they are entered on the compromised system all the time and as such probably known to any attacker (remember that you want sth stronger than username/password for a reason).
So you would have to send some identity verification like a copy of your passport (again out-of-band, so probably via mail or fax) when linking the authenticator to your account. |