Perimeter
10/18/2011
09:53 PM
Taher Elgamal
Taher Elgamal
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Authentication With Hardware

Needed: a unified way for users to log in websites regardless of the device they are using

Here are some thoughts about providing users and businesses ways for a website to authenticate a user all the way to the hardware connection to his computer or mobile device.

There are many cases where software methods are sufficient, of course, but higher grades of security might be required by certain applications.

More standard software stacks are needed to link the hardware authenticators to the users’ systems and, ultimately, to websites and servers so that trusted connections are better established. The Internet will likely not tolerate too many proprietary methods of authenticating users, and the likely outcome is a suite of protocols and APIs that become industry standards.

If the websites have a standard API that enables them to immediately interface to “any” hardware or software authenticator on the user’s computer, then changing authentication schemes will be a simple configuration change.

It would be really beneficial for the industry to provide a path that eventually achieves a unified way for users to log in websites regardless of the devices they are using. With the adoption of hardware and stronger software authentication into different platforms, the industry will be marching toward providing standard authentication techniques -- a dream discussed by many.

Recognized in the industry as the "inventor of SSL," Dr. Taher Elgamal led the SSL efforts at Netscape. He also wrote the SSL patent and promoted SSL as the Internet security standard within standard committees and the industry. Dr. Elgamal invented several industry and government standards in data security and digital signatures area, including the DSS government standard for digital signatures. In addition to serving on numerous corporate advisory boards, Dr. Elgamal is the Chief Security Officer at Axway, a global provider of multi-enterprise solutions and infrastructure. He holds a Ph.D. and M.S. in Computer Science from Stanford University. View more of his blog posts here.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-1421
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.

CVE-2013-2105
Published: 2014-04-22
The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.

CVE-2013-2187
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.

CVE-2013-4116
Published: 2014-04-22
lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

CVE-2013-4472
Published: 2014-04-22
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.

Best of the Web