Vulnerabilities / Threats
9/16/2009
06:12 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Consumers Accept Device Fingerprinting, Study Finds

To fight online fraud, consumers are warming to the idea of technology that identifies the device they're using.

Computer users are willing to accept device profiling if it leads to improved security and less sharing of personal information, according to a study conducted by the Ponemon Institute, an independent privacy research organization.

The study, Online Consumers' Reaction to Device Fingerprinting, was sponsored by ThreatMetrix, a security company that sells device profiling software.

Device profiling involves the analysis of information about an Internet user's hardware, software, and network traffic to identify typical usage patterns and to raise a red flag, if, for instance, the user is suddenly accessing a Web site with a different operating system or from a different country.

ThreatMetrix marketing VP Tom Grubb claims the company uses only public data to profile Internet users' machines, such as information about the browser and plug-ins being used, the operating system, TCP/IP packet headers, and sometimes cookies without any personally identifying information.

The Ponemon study found that 78% of the 551 adult Internet users surveyed believe online merchants, banks, and social networks should use technology, such as a "cookie" or software, to safeguard customers. But only 21% wanted to see online sites demand more personal data for authentication.

Almost 70% of respondents indicated that they could accept having their computers authenticated as part of an online purchase and 75% expressed a preference for computer authentication because it's easier than remembering passwords or answering questions about personal history.

Despite this, respondents also expressed worries that device identification could lead to exposure of personal information (33%) and that merchants might misuse device authentication data (12%).

The study demonstrates broad concern about online fraud but reluctance to be bothered with knowledge-based authentication or passwords. Consumers, in other words, want security but don't want to work for it.

In a phone interview, Larry Ponemon, chairman and founder of the Ponemon Institute, said the acceptance of device profiling was a surprise given the longstanding privacy worries about cookies and other tracking mechanisms.

"People are more likely to feel that the anonymity of a technology is more important than the privacy it creates," he said.

Avivah Litan, a Gartner VP and analyst who focuses on financial fraud, acknowledged that device identification is being used by online banks and credit card issuers to help prevent account takeovers. But she said the technology has limits.

"It's not foolproof at all," she said. "If a cyber criminal takes over your browser, it won't work."

The technology is most useful, she said, as one layer among many.


Get all the data from this year's InformationWeek 500 survey free for a limited time. Our report examines business and technology best practices as well as IT investment trends among the nation's most innovative IT users. It also provides industry comparisons against which you can benchmark your company's strategies. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2208
Published: 2014-12-28
CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n (newline) character before the end of a string.

CVE-2014-2209
Published: 2014-12-28
Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory.

CVE-2014-5386
Published: 2014-12-28
The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initial...

CVE-2014-6228
Published: 2014-12-28
Integer overflow in the string_chunk_split function in hphp/runtime/base/zend-string.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted arguments to the chunk_split ...

CVE-2014-6229
Published: 2014-12-28
The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrectly expects that a certain key string uses '\0' for termination, which allows remote attackers to obtain sensitive information by leveraging read access beyond the end of the string,...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.