Microsoft has revealed at a security panel at CeBIT that it is preparing to dump passwords in favour of two-factor authentication in forthcoming versions of Windows.
Detlef Eckert, the senior director in charge of Microsoft's Trustworthy Computing initiative, did not specify which form of two-factor authentication would be used in the next edition of the company's operating system, codenamed Longhorn
Acknowledging that in this day and age single factor authentication, in other words PASSWORDS, just aren't enough to secure corporate IT assets, Microsoft has announced much tighter integration of two factor authentication technologies into future versions of the Windows OS. While they do exist today, two factor auth is more of an add on to the OS than a core component, as a result, it is inherently not as secure as it could be.
One well known Online Financial Services provider has already begun to head down this route. Who might you ask? E*Trade.
For those of you unfamiliar with two factor authentication schemes, they can be summarized as authentication with two pieces of information. Typically these pieces of information amount to SOMETHING YOU KNOW and SOMETHING YOU HAVE. There are many examples. In the case of RSA SecureID the "something you know" is a PIN number and the "something you have" is a key fob with a code that changes every sixty seconds based on an algorithm that the authentication server knows based on the serial number of the fob and the time. If you lose the device, the PIN is useless and if you lose or forget the PIN, the device is useless.
Other approaches use RFID tags such that if the tag is in proximity to a sensor and the proper PIN is entered, the machine will unlock and when the sensor leaves the area, the machine will lock. Another well known approach to two factor authentication uses biometrics (a thumb/finger print, retina scan, etc…) and a PIN code. Again, if you lose the bio feature…well, you've got bigger problems then not accessing your computer systems unless of your name is Jack Bauer.
Two factors. Very secure.
1. Biometric identification is not easily made secure, since (a) it is vulnerable to a replay attack (play back the stream of bits from the retinal/fingerprint scanner), and (b) cannot be changed.
You don't have to have your finger cut off for the black hats to know the digital encoding of your fingerprint. Even if you know that they have your digital fingerprint, you can't do much about it-- you're stuck with your fingers.
Posted at 4:49AM on Dec 19th 2005 by Jonathan Rynd