Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Apple, Amazon Security Fails: Time For Change
Newest First  |  Oldest First  |  Threaded View
MarkSitkowski
MarkSitkowski,
 User Rank: Moderator
9/5/2012 | 12:46:36 AM
re: Apple, Amazon Security Fails: Time For Change
Whenever I read one of these cautionary tales, I wonder how long it will be before organisations realise that passwords, PIN codes, biometrics and eyeball scans are not the answer. As Andrew rightly says, if it's difficult, people won't use it. I personally, have a directory on my machine containing about 80 files, with the username and password for every online connection I make - and I'm in the security business.
Security hole? Definitely. Avoidable? Definitely.
How much easier it would be, if all I had to remember was just one key word, of arbitrary length and, when I had to login to something, I was presented with an alphabet, and a string of corresponding random zero's and one's. All I'd have to do, is enter the numbers matching my word, and nobody, unless they read my mind, would know what my word was. If they tried copying what I'd typed, it wouldn't match the second set of random numbers. A nine-year old could do use it.
Oh, yes. When I entered my key word for the first time, or decided to change it, perhaps I could be presented with a random array of jpeg's of letters, which I could drag and drop into a field, so that malware didn't know what my new word was. That would be easier than typing, and a nine-year old could manage that, too. Perhaps there already is such an authentication system and, perhaps, a couple of banks, cloud providers and law-enforcement agencies are already implementing it. Perhaps it's described in a document at www.designsim.com.au/What_is_S....
Mathew
Mathew,
 User Rank: Apprentice
8/17/2012 | 9:59:56 AM
re: Apple, Amazon Security Fails: Time For Change
Great comment, Anon. Reminds me of Norman Mailer's "Harlot's Ghost," in which one of the characters is trained in spycraft techniques which (if memory serves) involve applying arbitrary colors and object names to help memorize important words or concepts.
But the problem word in that statement is training--teaching yourself how to do this, then remembering what your system is.
So here's a suggestion: For those of us not so well-versed in such systems (myself included), use password safe software that works across PC/Mac, tablets, and smartphones. If you're using such software to keep track of unique passwords for every website you use--which you should be doing anyway--there's ample room to also track just which unique "mother's maiden name" you've used for any given website.
-- Mathew Schwartz
ANON1237925156805
ANON1237925156805,
 User Rank: Apprentice
8/16/2012 | 5:15:34 PM
re: Apple, Amazon Security Fails: Time For Change
No security question need be a problem because YOU DON'T HAVE TO GIVE THE RIGHT ANSWER!!! This info does not get verified. You are asked for a fact about yourself to minimize the risk of your forgetting the answer to the security question.

I began my "lying" strategy when banks would ask for my mother's maiden name so that they could verify my identity if I later needed to bank by phone. This was years before the internet.

When asked for my mother's maiden name I give a syllable from the middle that's a very obscure but charming word. No one else would think of it, but I now remember it right alongside her actual name.

The trick is to develop one fake answer for each of the researchable standard questions as it comes up. Once you've got it, always give that answer for that question. Make your fake answer relate to the question with an association that's strong for you. That way it'll be just as easy for you to remember as the correct answer.

For example, would-be predators can look up your city of birth but they can't guess or research if you give another city instead. I give the city and state where my parents lived at that time and where I lived for the first seven months of my life.

If asked for my grandmother's first name, I give the name of her favorite sister, first and married names. If asked for my high school, I give one of the school's cross streets. Etc., etc.

This strategy works very well even for technophobes; each of us has associations that will support our recall of well-crafted bogus answers. Get a small library and you're set. So coach your friends!
Andrew Hornback
Andrew Hornback,
 User Rank: Apprentice
8/14/2012 | 2:14:12 AM
re: Apple, Amazon Security Fails: Time For Change
Every time you make things "difficult" for a user to use, the more likely they're not to use it.

But, when you have the simplicity of "Oh look, one click and my entire life gets backed up on the cloud and I never have to worry about it"... that sells people on your solution.

What needs to happen is the ability for users to determine how many levels of security that they want for their accounts. Give a user the option of adding things like call back verification, two factor authentication, etc, etc. instead of applying a "one size fits all" solution across the board. Grandma storing her chicken cacciatore recipes on the cloud doesn't necessarily have the same security level requirements of someone doing on-line bill paying.

Andrew Hornback
InformationWeek Contributor
ANON1243950556912
ANON1243950556912,
 User Rank: Apprentice
8/13/2012 | 6:43:59 PM
re: Apple, Amazon Security Fails: Time For Change
My bank allowed me to sign up for online banking with my account number (available to anyone to whom I ever sent a check, or anyone whose check I cashed) and the last four digits of my phone number. Gee, I wonder how you could find out what someone's phone number is.

Typical security questions: "What is your grandfather's first name?" "What was the name of your high school?" and the ever-popular "Mother's maiden name."

But some halfway decent ones: Name of your first pet, favorite movie.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file