[geeks] Interesting: hardware security token for PayPal

[Charles Shannon Hendrix]

Sun, 01 Apr 2007 @ 00:21 -0600, Dan Duncan said:

> On 3/31/07, Charles Shannon Hendrix <shannon at widomaker.com> wrote:
> > It seems to me like it would be fairly cheap to build a device like that
> > which gathered entropy from its environment.
> >
> > No two units are likely to have the same hash of temperature, vibration,
> > drops, torque (human holding it), etc.
> 
> How would you then use it to log in if the other end didn't know what
> number you'd be presenting?

Sorry, I was thinking of portable random number generation, which I
still think is an interesting idea.

Also, some cards only use the generated number for the first phase
of PKI.  I don't really see the point, except maybe in cases where
you could use the card without having a computer.

I'm kind of curious how they garantee sync in the numbers. It seems like
it would be trivial to get out of sync and make the whole batch useless.
Or, does each number have a non-random serial?

Aside:

Once broken or compromised, the increased level of trust in newer
security systems makes it harder to get things fixed. Quite a few
systems penalize the victims rather than the attackers. In fact, so far
it seems to me that most of them do.

The problem with this is obvious: if for any reason you are targeted,
the damage done is not your credit, your home, or whatever... the damage
is that security companies will stop serving you, because even though
you did no wrong, you are no longer worth the resources.

In fact, just like spammers attack filters by poisoning them, criminals
will begin poisoning security systems. Not to break them, but to cause
them to stop trusting the users.

The other big issue is biometrics, which is a disaster waiting to
happen.

None of the proponents will face the reality: once stolen, biometric
identify is stolen forever.

The answer to most weak security is to add second layer.  I submit that
if you do this with biometrics, you might as well eliminate biometrics
and just use the secondary layer.

In fact, two non-biometric security systems used in combination are
probably more secure and less risky than biometrics in the majority of
cases.

Like Mike Swain once said, the best place to put the lock is in people's
head.


-- 
shannon / 4649 5920 4320 204e 4452 5420 5348 5920 4820 2056 2054 434d 2048 
-------'  4d54 2045 204e 5259 4820 444e 0a53