Steve Gibson Revolutionizing Website Login and Authentication with SQRL SQRL
|
|
|
- Suzan Barker
- 8 years ago
- Views:
Transcription
1
2 SQRL A simple & straightforward, open, intellectual property unencumbered, easily explained, provably secure, pseudonymous, 2-party, web domain based, authenticated identity solution for the Internet. (Secure Quick Reliable Login.)
3 Presentation outline: Identity authentication yesterday & today. What identity authentication needs to be. SQRL s proposal for tomorrow. The concept and the algorithm. Benefits and consequences. Operational details. What are the problems? Solutions to the problems. Known attacks offline and online. Where do we get the crypto? Where SQRL stands today. How does it get adopted? Summary & questions?
4 The earliest authenticated identity: Local terminal login: Identification Authentication by username by password Remote (Internet) user login: Telnet FTP And the progress since then? Progress?... Huh?...
5 Identity Auth today: (Broken) 2-Party Systems Ad hoc, with differing, arbitrary characteristics & requirements. Many very poor implementations. Credentials routinely escaping. In self-defense, users bear burden of protecting themselves: Never use the same password twice! Give fake responses to security questions. Remember everything you ve ever done!
6 Identity Auth today: (Broken) 3-Party Systems Post-Snowden, no one trusts (nor should) any 3 rd party. Paranoia is running high. The model is we re in the middle. Hosted by for profit entities. Utilize closed you can trust us proprietary magic.
7 Just like information, identity authentication wants to be free! Identity authentication can not be a profit center. The winning solution will be 100% license-free and open. (like usernames & passwords only something that works!) It will be understandable, clean and simple. It will have a straightforward easily understood security model. It will be easy and inexpensive to implement. It will offer low friction incremental adoption.
8 SQRL in a nutshell User generates one Master Identity for everything, forever. (A randomly chosen 256-bit token.) A web site s domain name is used to key a hash which produces a private key. The matching public key is created and registered with the website as the user s identity token for that site. To authenticate the user at logon, the website presents a per-logon nonce. The user signs the nonce using the site-specific private key and returns both the site-specific public key and the nonce signed by the matching private key.
9 SQRL in a nutshell
10 This means: Users are per-site pseudonymous. They present a unique but fixed identity to every site. Inter-site tracking is eliminated. These unique identities are synthesized from the site s domain name, so no per-site data needs to be stored. Users give web servers no secrets to keep. Web servers receive an identity token that is only meaningful for that site. The use of a nonce using a simple challenge/response mechanism prevents reuse / replay attacks.
11 Two compatible modes of operation Same device login If the device being logged in already has a SQRL client installed, it can respond to the website s SQRL URL. Cross device login If the user has a SQRL client installed in their smartphone, the smartphone can use the website s SQRL QR code to perform a cross-device login. Note: In neither case are ANY user credentials entered into the machine s keyboard. Using SQRL, the user just becomes magically logged in.
12 Identity management & options
13 What are the problems? (1 of 2) We still need to authenticate the user to their device. (One way to look at this is that we have reeled the authentication problem way in. With secure trans-network authentication, now the problem is mostly local and that s much easier.) In the future (and kinda now) TouchID might be sufficient. Until then, SQRL uses a traditional password for something the user knows authentication. Since this single password is used only for local authentication to the SQRL client, it is never transmitted and is unlikely to be forgotten especially as SQRL becomes often used.
14 What are the problems? (2 of 2) Without a 3 rd party, the user has no recourse. I forgot my password! I just changed my password and forgot the new one! Malware got into my phone and stole my SQRL identity! The whole point of SQRL is that websites cannot help either. (If they could help, they could be hacked.) So we had to come up with some sort of secure emergency recovery system that worked entirely on the client side
15 The SQRL Rescue Code An offline, guaranteed-high-entropy, 24-digit random number. Example: (Not user-generated, since people are not random.) Generated randomly when a SQRL identity is generated. NEVER stored in any device, must be printed or recorded and stored offline. Has two special powers: Forgives any lost or forgotten password, so used for password recovery. Unlocks SQRL s Identity Lock for identity management
16 SQRL s Identity Lock protocol (1 of 3) A unique application of Diffie-Hellman key agreement. SQRL clients carry sufficient information to generate new identity associations, but NOT to authenticate associations. Only the Rescue Code is able to authenticate (and thus unlock ) an association. Since the Rescue Code is never stored in any SQRL client, it cannot be stolen by malware or bad guys. If, somehow, a user were to lose control of their identity, bad guys could not lock them out of their accounts. But users can lock the bad guys out by using their rescue code to proactively change and take back their identity.
17 SQRL s Identity Lock protocol (2 of 3) Diffie-Hellman Key Agreement: If we have public key one (PubKey1) and secret key one (SecKey1) and public key two (PubKey2) and secret key two (SecKey2), then: DHKA(PubKey1,SecKey2) = DHKA(PubKey2,SecKey1) IdentityLock := MakePublic(IdentityUnlock) ServerUnlock := MakePublic(RandomLock) DHKA(IdentityLock,RandomLock) = DHKA(ServerUnlock,IdentityUnlock) VerifyUnlock := MakePublic( DHKA(IdentityLock,RandomLock))
18 SQRL s Identity Lock protocol (3 of 3) Performed during identity creation Performed to lock identity Performed to unlock identity See:
19 Known (offline) attacks Only known weakness is brute-force password cracking. SQRL adds some unique technology to the industry: Very time consuming memory-hard one-time password process: Subsequent Password Hint for successive re-auths.
20 Known (online) attacks Spoofed SQRL login for site B on site A: LooksInnocent.com presents user with SQRL login for and obtains logged in session. Spoofed site presents user with SQRL login for the real Amazon.com site. Warn user of IP address differing between queries! Man-In-The-Middle interception of HTTPS If attacker has this power, authentication is the least of the user s problems! More and more of the Internet relies crucially upon the functional strength and integrity enforced by the Certificate Authority (CA) system.
21 Off the shelf implementation crypto Colin Percival s Scrypt for memory-hard, acceleration resistant password-based key derivation. A deliberately time-consuming PBKDF2 construction, using XOR-sum chaining with Scrypt as its PRF, to render brute-force cracking orders of magnitude more difficult and daunting. Dan Bernstein s NaCl elliptic-curve cryptosystem. EdDSA (elliptic curve digital signature system). Elliptic curve Diffie-Hellman (via a scalarmult on EC). Cross-platform Libsodium library. Misc. crypto pieces SHA256, SHA512, HMAC256, etc.
22 Where does SQRL stand today? Client support GRC s reference (fully usable) SQRL client (Github) A functioning Android client (Github) A SQRL client in Python. (Github) A SQRL client in Java. (Github) A Windows Phone 8 Proof of Concept. (Github) Some work on a ios library. Server support GRC s ISAPI (Windows IIS) reference library. (Github) A Drupal implementation (Github) A PHP server-side implementation (Github) A Dot-Net full SQRL implementation. (Github) A Haskell implementation. Various sites, guides and articles.
23 How does SQRL get adopted? Everything about SQRL is low-friction : A user only needs ONE identity created ONCE. (Even if it s not heavily used at first, it s free and compelling.) Some sites need, and will appreciate, ultra-low-friction identification. Over time, users will (hopefully) ask for SQRL support everywhere. Adding server-side SQRL support is already easy and will become easier. Most of SQRL s heavy lift (which already is not very heavy) is on the client, which only needs to be implemented once.
24 In summary Encourages one identity for everything. Secure against website breaches (no secrets to keep). Pseudonymous, prevents tracking. Users choose to de-anonymize. Simple, straightforward, open, non-proprietary, completely free, Provably secure, understandable and easily auditable. Most complexity in the client to ease server-side development. Can co-exist side-by-side with existing identity & authentication. Low-friction adoption so perhaps it has a chance?
25 Questions?
Authentication Types. Password-based Authentication. Off-Line Password Guessing
Authentication Types Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4:
2.4: Authentication Authentication types Authentication schemes: RSA, Lamport s Hash Mutual Authentication Session Keys Trusted Intermediaries
Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application
WHITE PAPER AUGUST 2014. Preventing Security Breaches by Eliminating the Need to Transmit and Store Passwords
WHITE PAPER AUGUST 2014 Preventing Security Breaches by Eliminating the Need to Transmit and Store Passwords 2 WHITE PAPER: PREVENTING SECURITY BREACHES Table of Contents on t Become the Next Headline
High Security Online Backup. A Cyphertite White Paper February, 2013. Cloud-Based Backup Storage Threat Models
A Cyphertite White Paper February, 2013 Cloud-Based Backup Storage Threat Models PG. 1 Definition of Terms Secrets Passphrase: The secrets passphrase is the passphrase used to decrypt the 2 encrypted 256-bit
Web Security. Crypto (SSL) Client security Server security 2 / 40. Web Security. SSL Recent Changes in TLS. Protecting the Client.
1 / 40 Crypto () Client security Server security 2 / 40 Trusting The Server s Client SET The Failure of SET Aside: The SET Root Certificate The Client s Server Who Issues Web Certificates? Mountain America
Dashlane Security Whitepaper
Dashlane Security Whitepaper November 2014 Protection of User Data in Dashlane Protection of User Data in Dashlane relies on 3 separate secrets: The User Master Password Never stored locally nor remotely.
Contents. Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008
Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008 Contents Authentication and Identity Assurance The Identity Assurance continuum Plain Password Authentication
Connected from everywhere. Cryptelo completely protects your data. Data transmitted to the server. Data sharing (both files and directory structure)
Cryptelo Drive Cryptelo Drive is a virtual drive, where your most sensitive data can be stored. Protect documents, contracts, business know-how, or photographs - in short, anything that must be kept safe.
Secure Remote Password (SRP) Authentication
Secure Remote Password (SRP) Authentication Tom Wu Stanford University tjw@cs.stanford.edu Authentication in General What you are Fingerprints, retinal scans, voiceprints What you have Token cards, smart
SENSE Security overview 2014
SENSE Security overview 2014 Abstract... 3 Overview... 4 Installation... 6 Device Control... 7 Enrolment Process... 8 Authentication... 9 Network Protection... 12 Local Storage... 13 Conclusion... 15 2
Information Security Basic Concepts
Information Security Basic Concepts 1 What is security in general Security is about protecting assets from damage or harm Focuses on all types of assets Example: your body, possessions, the environment,
Enhancing Organizational Security Through the Use of Virtual Smart Cards
Enhancing Organizational Security Through the Use of Virtual Smart Cards Today s organizations, both large and small, are faced with the challenging task of securing a seemingly borderless domain of company
OPENID AUTHENTICATION SECURITY
OPENID AUTHENTICATION SECURITY Erik Lagercrantz and Patrik Sternudd Uppsala, May 17 2009 1 ABSTRACT This documents gives an introduction to OpenID, which is a system for centralised online authentication.
CSC 474 -- Network Security. User Authentication Basics. Authentication and Identity. What is identity? Authentication: verify a user s identity
CSC 474 -- Network Security Topic 6.2 User Authentication CSC 474 Dr. Peng Ning 1 User Authentication Basics CSC 474 Dr. Peng Ning 2 Authentication and Identity What is identity? which characteristics
RFG Secure FTP. Web Interface
RFG Secure FTP Web Interface Step 1: Getting to the Secure FTP Web Interface: Open your preferred web browser and type the following address: http://ftp.raddon.com After you hit enter, you will be taken
Key Management. CSC 490 Special Topics Computer and Network Security. Dr. Xiao Qin. Auburn University http://www.eng.auburn.edu/~xqin xqin@auburn.
CSC 490 Special Topics Computer and Network Security Key Management Dr. Xiao Qin Auburn University http://www.eng.auburn.edu/~xqin xqin@auburn.edu Slide 09-1 Overview Key exchange Session vs. interchange
Authentication. Computer Security. Authentication of People. High Quality Key. process of reliably verifying identity verification techniques
Computer Security process of reliably verifying identity verification techniques what you know (eg., passwords, crypto key) what you have (eg., keycards, embedded crypto) what you are (eg., biometric information)
Apache Milagro (incubating) An Introduction ApacheCon North America
Apache Milagro (incubating) An Introduction ApacheCon North America Apache Milagro will establish a new independent security framework for the Internet A Distributed Cryptosystem Secure the Future of the
Multi Factor Authentication API
GEORGIA INSTITUTE OF TECHNOLOGY Multi Factor Authentication API Yusuf Nadir Saghar Amay Singhal CONTENTS Abstract... 3 Motivation... 3 Overall Design:... 4 MFA Architecture... 5 Authentication Workflow...
The increasing popularity of mobile devices is rapidly changing how and where we
Mobile Security BACKGROUND The increasing popularity of mobile devices is rapidly changing how and where we consume business related content. Mobile workforce expectations are forcing organizations to
Passcape Software. DPAPI flaw. Vulnerability of DPAPI data protection in Win2K, Win2K3, Windows Server 2008, and Windows Server 2012
DPAPI flaw Vulnerability of DPAPI data protection in Win2K, Win2K3, Windows Server 2008, and Windows Server 2012 Content 1 Brief description of the vulnerability 2 1.1 The... problem 2 1.2 Affected...
SY0-201. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users.
system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users. From a high-level standpoint, attacks on computer systems and networks can be grouped
Sophos Mobile Control User guide for Apple ios. Product version: 4
Sophos Mobile Control User guide for Apple ios Product version: 4 Document date: May 2014 Contents 1 About Sophos Mobile Control...3 2 About this guide...4 3 Login to the Self Service Portal...5 4 Set
Crypho Security Whitepaper
Crypho Security Whitepaper Crypho AS Crypho is an end-to-end encrypted enterprise messenger and file-sharing application. It achieves strong privacy and security using well-known, battle-tested encryption
2-FACTOR AUTHENTICATION FOR MOBILE APPLICATIONS: INTRODUCING DoubleSec
2-FACTOR AUTHENTICATION FOR MOBILE APPLICATIONS: INTRODUCING DoubleSec TECHNOLOGY WHITEPAPER DSWISS LTD INIT INSTITUTE OF APPLIED INFORMATION TECHNOLOGY JUNE 2010 V1.0 1 Motivation With the increasing
Designing a Secure Client-Server System Master of Science Thesis in the Programme Software Engineering & Technology
Designing a Secure Client-Server System Master of Science Thesis in the Programme Software Engineering & Technology FREDRIK ANDERSSON Department of Computer Science and Engineering CHALMERS UNIVERSITY
Take-home points. Distributed Systems Security II. Remember digital signatures. Today: Auth protocols 15-440
Distributed Systems Security II 5-440 Take-home points What does using public-key for our authentication buy us? Compare kerberos (needham-schroeder) and SSL with a certificate authority Metrics: Scaling,
Salesforce1 Mobile Security Guide
Salesforce1 Mobile Security Guide Version 1, 1 @salesforcedocs Last updated: December 8, 2015 Copyright 2000 2015 salesforce.com, inc. All rights reserved. Salesforce is a registered trademark of salesforce.com,
Using Foundstone CookieDigger to Analyze Web Session Management
Using Foundstone CookieDigger to Analyze Web Session Management Foundstone Professional Services May 2005 Web Session Management Managing web sessions has become a critical component of secure coding techniques.
Evaluation and Implementation of SQRL and U2F as 2 nd Factor Authenticators for CERN Single Sign-On
Evaluation and Implementation of SQRL and U2F as 2 nd Factor Authenticators for CERN Single Sign-On September 2015 Author: Azqa Nadeem Supervisors: Vincent Brillault Stefan Lueders CERN Openlab Summer
YubiKey Authentication Module Design Guideline
YubiKey Authentication Module Design Guideline Yubico Application Note Version 1.0 May 7, 2012 Introduction Disclaimer Yubico is the leading provider of simple, open online identity protection. The company
Web Security. Mahalingam Ramkumar
Web Security Mahalingam Ramkumar Issues Phishing Spreading misinformation Cookies! Authentication Domain name DNS Security Transport layer security Dynamic HTML Java applets, ActiveX, JavaScript Exploiting
STRONGER AUTHENTICATION for CA SiteMinder
STRONGER AUTHENTICATION for CA SiteMinder Adding Stronger Authentication for CA SiteMinder Access Control 1 STRONGER AUTHENTICATION for CA SiteMinder Access Control CA SITEMINDER provides a comprehensive
Is Your SSL Website and Mobile App Really Secure?
Is Your SSL Website and Mobile App Really Secure? Agenda What is SSL / TLS SSL Vulnerabilities PC/Server Mobile Advice to the Public Hong Kong Computer Emergency Response Team Coordination Centre 香 港 電
Vidder PrecisionAccess
Vidder PrecisionAccess Security Architecture February 2016 910 E HAMILTON AVENUE. SUITE 410 CAMPBELL, CA 95008 P: 408.418.0440 F: 408.706.5590 WWW.VIDDER.COM Table of Contents I. Overview... 3 II. Components...
DiamondStream Data Security Policy Summary
DiamondStream Data Security Policy Summary Overview This document describes DiamondStream s standard security policy for accessing and interacting with proprietary and third-party client data. This covers
Secure Authentication and Session. State Management for Web Services
Lehman 0 Secure Authentication and Session State Management for Web Services Clay Lehman CSC 499: Honors Thesis Supervised by: Dr. R. Michael Young Lehman 1 1. Introduction Web services are a relatively
Public Key Applications & Usage A Brief Insight
Public Key Applications & Usage A Brief Insight Scenario :: Identification, Authentication & Non- Repudiation :: Confidentiality :: Authenticity, requirements and e-business Integrity for electronic transaction
EURECOM VPN SSL for students User s guide
EURECOM VPN SSL for students User s guide Table of Contents Introduction... 2 Login process... 2 Portail main page... 2 Prerequisite... 2 RSA SecurId software token... 3 First usage of RSA SecurID token...
Mobile Device Management Version 8. Last updated: 17-10-14
Mobile Device Management Version 8 Last updated: 17-10-14 Copyright 2013, 2X Ltd. http://www.2x.com E mail: info@2x.com Information in this document is subject to change without notice. Companies names
Client Server Registration Protocol
Client Server Registration Protocol The Client-Server protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes are
IPsec Details 1 / 43. IPsec Details
Header (AH) AH Layout Other AH Fields Mutable Parts of the IP Header What is an SPI? What s an SA? Encapsulating Security Payload (ESP) ESP Layout Padding Using ESP IPsec and Firewalls IPsec and the DNS
Centralized Self-service Password Reset: From the Web and Windows Desktop
Centralized Self-service Password Reset: From the Web and Windows Desktop Self-service Password Reset Layer v.3.2-007 PistolStar, Inc. dba PortalGuard PO Box 1226 Amherst, NH 03031 USA Phone: 603.547.1200
Single Sign-On for the Internet: A Security Story. Eugene Tsyrklevich eugene@tsyrklevich.name Vlad Tsyrklevich vlad902@gmail.com
Single Sign-On for the Internet: A Security Story Eugene Tsyrklevich eugene@tsyrklevich.name Vlad Tsyrklevich vlad902@gmail.com BlackHat USA, Las Vegas 2007 Introduction With the explosion of Web 2.0 technology,
SAP Single Sign-On 2.0 Overview Presentation
SAP Single Sign-On 2.0 Overview Presentation March 2016 Public Agenda SAP security portfolio Overview SAP Single Sign-On Single sign-on main scenarios Capabilities Summary 2016 SAP SE or an SAP affiliate
XYPRO Technology Brief: Stronger User Security with Device-centric Authentication
Ken Scudder Senior Director Business Development & Strategic Alliances XYPRO Technology Talbot A. Harty CEO DeviceAuthority XYPRO Technology Brief: Stronger User Security with Device-centric Authentication
Is your data safe out there? -A white Paper on Online Security
Is your data safe out there? -A white Paper on Online Security Introduction: People should be concerned of sending critical data over the internet, because the internet is a whole new world that connects
E-Commerce Security. The Client-Side Vulnerabilities. Securing the Data Transaction LECTURE 7 (SECURITY)
E-Commerce Security An e-commerce security system has four fronts: LECTURE 7 (SECURITY) Web Client Security Data Transport Security Web Server Security Operating System Security A safe e-commerce system
Bit Chat: A Peer-to-Peer Instant Messenger
Bit Chat: A Peer-to-Peer Instant Messenger Shreyas Zare shreyas@technitium.com https://technitium.com December 20, 2015 Abstract. Bit Chat is a peer-to-peer instant messaging concept, allowing one-to-one
Copyright: WhosOnLocation Limited
How SSO Works in WhosOnLocation About Single Sign-on By default, your administrators and users are authenticated and logged in using WhosOnLocation s user authentication. You can however bypass this and
Unipass Identity User Guide & FAQ Document v1.1
Unipass Identity User Guide & FAQ Document v1.1 Some background information regarding Unipass Identity and a summary of some of the most commonly asked questions relating to your Unipass Identity. UIdP
User Identity and Authentication
User Identity and Authentication WordPress, 2FA, and Single Sign-On Isaac Potoczny-Jones ijones@tozny.com http://tozny.com About the Speaker Galois, Inc. - @galoisinc. Research & Development for computer
Copyright 2013, 3CX Ltd. http://www.3cx.com E-mail: info@3cx.com
Manual Copyright 2013, 3CX Ltd. http://www.3cx.com E-mail: info@3cx.com Information in this document is subject to change without notice. Companies names and data used in examples herein are fictitious
Multi-factor authentication
CYBER SECURITY OPERATIONS CENTRE (UPDATED) 201 (U) LEGAL NOTICE: THIS PUBLICATION HAS BEEN PRODUCED BY THE DEFENCE SIGNALS DIRECTORATE (DSD), ALSO KNOWN AS THE AUSTRALIAN SIGNALS DIRECTORATE (ASD). ALL
White Paper: Multi-Factor Authentication Platform
White Paper: Multi-Factor Authentication Platform Version: 1.4 Updated: 29/10/13 Contents: About zero knowledge proof authentication protocols: 3 About Pairing-Based Cryptography (PBC) 4 Putting it all
The Security Behind Sticky Password
The Security Behind Sticky Password Technical White Paper version 3, September 16th, 2015 Executive Summary When it comes to password management tools, concerns over secure data storage of passwords and
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
Transport Level Security
Transport Level Security Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
Web and Email Security 1 / 40
Web and 1 / 40 Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why
HP ProtectTools Windows Mobile
HP ProtectTools Windows Mobile White Paper Introduction... 2 Risks... 2 Features... 3 Password Hashing... 4 Password Generation... 5 Password Types... 5 Strong Alphanumeric Passwords... 5 Password Lifetime...5
A Security Survey of Strong Authentication Technologies
A Security Survey of Strong Authentication Technologies WHITEPAPER Contents Introduction... 1 Authentication Methods... 2 Classes of Attacks on Authentication Mechanisms... 5 Security Analysis of Authentication
SecureCom Mobile s mission is to help people keep their private communication private.
About SecureCom Mobile SecureCom Mobile s mission is to help people keep their private communication private. We believe people have a right to share ideas with each other, confident that only the intended
Security: Focus of Control. Authentication
Security: Focus of Control Three approaches for protection against security threats a) Protection against invalid operations b) Protection against unauthorized invocations c) Protection against unauthorized
WHITE PAPER Usher Mobile Identity Platform
WHITE PAPER Usher Mobile Identity Platform Security Architecture For more information, visit Usher.com info@usher.com Toll Free (US ONLY): 1 888.656.4464 Direct Dial: 703.848.8710 Table of contents Introduction
Account Management: A Deployment and Usability Problem Phillip Hallam- Baker VP & Principal Scientist, Comodo Group Inc.
Account Management: A Deployment and Usability Problem Phillip Hallam- Baker VP & Principal Scientist, Comodo Group Inc. Abstract Account management is the biggest challenge most Web users face today.
Lecture 9: Application of Cryptography
Lecture topics Cryptography basics Using SSL to secure communication links in J2EE programs Programmatic use of cryptography in Java Cryptography basics Encryption Transformation of data into a form that
PASSWORD MANAGEMENT. February 2008. The Government of the Hong Kong Special Administrative Region
PASSWORD MANAGEMENT February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without
Cryptographic Key Infrastructure
Cryptographic Key Infrastructure Goal: bind identity to key Classical: not possible as all keys are shared Use protocols to agree on a shared key (see earlier) Public key: bind identity to public key Crucial
KEYSTROKE DYNAMIC BIOMETRIC AUTHENTICATION FOR WEB PORTALS
KEYSTROKE DYNAMIC BIOMETRIC AUTHENTICATION FOR WEB PORTALS Plurilock Security Solutions Inc. www.plurilock.com info@plurilock.com 2 H IGHLIGHTS: PluriPass is Plurilock static keystroke dynamic biometric
Cryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 9: Authentication protocols, digital signatures Ion Petre Department of IT, Åbo Akademi University 1 Overview of
Working Copy 1.4 users manual
Working Copy 1.4 users manual Introduction 3 Cloning repositories 3 Accessing files 3 Committing changes 4 Staying up-to-date 4 Remotes 5 Clone catalog 5 SSH keys 6 Viewing and editing files 6 File changes
SOOKASA WHITEPAPER SECURITY SOOKASA.COM
SOOKASA WHITEPAPER SECURITY SOOKASA.COM Sookasa Overview Sookasa was founded in 2012 by a team of leading security experts. The company s patented file-level encryption enables enterprises to protect data
Sticky Password 7. Sticky Password 7 is the latest, most advanced, portable, cross platform version of the powerful yet
Sticky Password 7 Reviewer Guide Introduction Sticky Password 7 is the latest, most advanced, portable, cross platform version of the powerful yet simple password manager and form-filler. Its main goal
The Password Problem Will Only Get Worse
The Password Problem Will Only Get Worse New technology for proving who we are Isaac Potoczny-Jones Galois & SEQRD ijones@seqrd.com @SyntaxPolice Goals & Talk outline Update the group on authentication
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks
MOMENTUM - A MEMORY-HARD PROOF-OF-WORK VIA FINDING BIRTHDAY COLLISIONS. DANIEL LARIMER dlarimer@invictus-innovations.com Invictus Innovations, Inc
MOMENTUM - A MEMORY-HARD PROOF-OF-WORK VIA FINDING BIRTHDAY COLLISIONS DANIEL LARIMER dlarimer@invictus-innovations.com Invictus Innovations, Inc ABSTRACT. We introduce the concept of memory-hard proof-of-work
Thick Client Application Security
Thick Client Application Security Arindam Mandal (arindam.mandal@paladion.net) (http://www.paladion.net) January 2005 This paper discusses the critical vulnerabilities and corresponding risks in a two
TOPIC HIERARCHY. Distributed Environment. Security. Kerberos
KERBEROS TOPIC HIERARCHY Distributed Environment Security Privacy Authentication Authorization Non Repudiation Kerberos ORIGIN MIT developed Kerberos to protect network services. Developed under the Project
Entrust IdentityGuard
+1-888-437-9783 sales@identisys.com IdentiSys.com Distributed by: Entrust IdentityGuard is an award-winning software-based authentication enterprises and governments. The solution serves as an organization's
Data Protection Act 1998. Guidance on the use of cloud computing
Data Protection Act 1998 Guidance on the use of cloud computing Contents Overview... 2 Introduction... 2 What is cloud computing?... 3 Definitions... 3 Deployment models... 4 Service models... 5 Layered
Security for mobile apps
November 2014 Security for mobile apps This white paper provides education on security considerations and requirements for mobile apps. 1 Contents Authentication & security for mobile apps 3 Securing mobile
The State of Modern Password Cracking
SESSION ID: PDAC-W05 The State of Modern Password Cracking Christopher Camejo Director of Threat and Vulnerability Analysis NTT Com Security @0x434a Presentation Overview Password Hashing 101 Getting Hashes
Reset Virtual Gateway Password Job Aid
Summary of Job Aid In order to access a Virtual Gateway s business service, you must first log on to the Virtual Gateway (VG). From the Virtual Gateway s website (www.mass.gov/vg), click Logon to Virtual
This session was presented by Jim Stickley of TraceSecurity on Wednesday, October 23 rd at the Cyber Security Summit.
The hidden risks of mobile applications This session was presented by Jim Stickley of TraceSecurity on Wednesday, October 23 rd at the Cyber Security Summit. To learn more about TraceSecurity visit www.tracesecurity.com
Usable Crypto: Introducing minilock. Nadim Kobeissi HOPE X, NYC, 2014
Usable Crypto: Introducing minilock Nadim Kobeissi HOPE X, NYC, 2014 2012 Browsers are an environment that is hostile to cryptography Malleability of the JavaScript runtime. The lack of low-level (system-level)
Architecture and Data Flow Overview. BlackBerry Enterprise Service 10 721-08877-123 Version: 10.2. Quick Reference
Architecture and Data Flow Overview BlackBerry Enterprise Service 10 721-08877-123 Version: Quick Reference Published: 2013-11-28 SWD-20131128130321045 Contents Key components of BlackBerry Enterprise
Secure Socket Layer (SSL) and Transport Layer Security (TLS)
Secure Socket Layer (SSL) and Transport Layer Security (TLS) Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available
Internet Banking Two-Factor Authentication using Smartphones
Internet Banking Two-Factor Authentication using Smartphones Costin Andrei SOARE IT&C Security Master Department of Economic Informatics and Cybernetics Bucharest University of Economic Studies, Romania
Key & Data Storage on Mobile Devices
Key & Data Storage on Mobile Devices Advanced Computer Networks 2015/2016 Johannes Feichtner johannes.feichtner@iaik.tugraz.at Outline Why is this topic so delicate? Keys & Key Management High-Level Cryptography
Dispatch: A Unique Email Security Solution
Dispatch: A Unique Email Security Solution 720 836 1222 sales / support sales@absio.com email www.absio.com web 8740 Lucent Boulevard, Ste 101 Highlands Ranch, CO, 80129 1 110-WP005-1 Organizations use
SchoolBooking SSO Integration Guide
SchoolBooking SSO Integration Guide Before you start This guide has been written to help you configure SchoolBooking to operate with SSO (Single Sign on) Please treat this document as a reference guide,
Transport Layer Security Protocols
SSL/TLS 1 Transport Layer Security Protocols Secure Socket Layer (SSL) Originally designed to by Netscape to secure HTTP Version 2 is being replaced by version 3 Subsequently became Internet Standard known
Check Point FW-1/VPN-1 NG/FP3
Check Point FW-1/VPN-1 NG/FP3 Implementation Guide Copyright Copyright 2006, CRYPTOCard Corp. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval
Configuring Secure Socket Layer (SSL)
7 Configuring Secure Socket Layer (SSL) Contents Overview...................................................... 7-2 Terminology................................................... 7-3 Prerequisite for Using
CrashPlan Security SECURITY CONTEXT TECHNOLOGY
TECHNICAL SPECIFICATIONS CrashPlan Security CrashPlan is a continuous, multi-destination solution engineered to back up mission-critical data whenever and wherever it is created. Because mobile laptops
Own your LAN with Arp Poison Routing
Own your LAN with Arp Poison Routing By: Rorik Koster April 17, 2006 Security is a popular buzzword heard every day throughout our American culture and possibly even more so in our global economy. From
Authentication Tokens
State Capitol P.O. Box 2062 Albany, NY 12220-0062 www.its.ny.gov New York State Information Technology Standard IT Standard: Authentication Tokens No: NYS-S14-006 Updated: 05/15/2015 Issued By: NYS ITS
Sichere Software- Entwicklung für Java Entwickler
Sichere Software- Entwicklung für Java Entwickler Dominik Schadow Senior Consultant Trivadis GmbH 05/09/2012 BASEL BERN LAUSANNE ZÜRICH DÜSSELDORF FRANKFURT A.M. FREIBURG I.BR. HAMBURG MÜNCHEN STUTTGART
CNT5410 - Computer and Network Security Review/Wrapup
CNT5410 - Computer and Network Security Review/Wrapup Professor Kevin Butler Fall 2015 Review What did we talk about this semester? Cryptography secret vs public-key key exchange (Diffie-Hellman) symmetric
An Improved Authentication Protocol for Session Initiation Protocol Using Smart Card and Elliptic Curve Cryptography
ROMANIAN JOURNAL OF INFORMATION SCIENCE AND TECHNOLOGY Volume 16, Number 4, 2013, 324 335 An Improved Authentication Protocol for Session Initiation Protocol Using Smart Card and Elliptic Curve Cryptography