Isys20261 lecture 14
-
Upload
wil-ferraciolli -
Category
Documents
-
view
99 -
download
0
Transcript of Isys20261 lecture 14
Computer Security Management(ISYS20261)Lecture 14 – More on Passwords
Module Leader: Dr Xiaoqi Ma
School of Science and Technology
Computer Security ManagementPage 2
Last week …
• Passwords
• PINs
• Challenge-response
Computer Security ManagementPage 3
Today
• Captchas
• Graphical passwords
• How to recover a forgotten password
Computer Security ManagementPage 4
Captchas (1)
• Completely Automated Public Turing test to tell Computers and Humans Apart (von Ahn, Blum, Hopper and Langford, 2000)
• Challenge-response test to ensure that the user is a human– E.g. to prevent automated account harvesting
• Captcha is a computer generated puzzle, i.e. a distorted image of a number/character sequence
• User has to type in the number/character sequence
• Most humans can read the image but current software can’t
• Examples:
Computer Security ManagementPage 5
Captchas (2)
• Sequence:
"squestra"
request
authenticated
System
• Problems:– Blind or visually impaired users?
– Mobile devices with limited hardware capabilities?
Computer Security ManagementPage 6
How to crack Captchas
• Human operators (“Sweatshop”)
• Forward captcha from original site onto attackers web site and let users unwittingly solve the puzzle! (in real time)
"squestra"
request to logon toAttacker's 'free' site
authenticated
Attacker'sweb site
System
request to logon to'protected' site
"squestra"
authenticated
Computer Security ManagementPage 7
Graphical authentication
• Human memory for images is better than for words
• New approach: graphical (image based) authentication
• Graphical passwords– Recognition based
– User to select picture among a set of distractors
– Example: PassFaces
• Position based passwords– Click on right region on an image (challenge)
– Chose the correct pattern
– Example: GrIDsure
Computer Security ManagementPage 8
Password recovery
• Passwords are often forgotten– Infrequent use
– Forced change (due to password policy)
– etc
• Password (credential) needs to be recovered
• Easy option: send me a new (or my old) password via email
• Not really secure!
• Need for authentication
• Better option: challenge-response based recovery
Computer Security ManagementPage 9
Credential recovery
• User-triggered process to reset forgotten passwords
• Uses knowledge-based authentication
• Two varieties– Answering enrolled challenges
– Recovery without enrolment
Computer Security ManagementPage 10
Recovery with enrolment
• Users enrol set of challenges and responses
• On re-set they have to prove their identity by answering challenges
• Issues– Which challenge-responses should be used?
– Who chooses them?
Computer Security ManagementPage 11
Recovery without enrolment
• Probing knowledge shared between system and user:– Probing recent interactions with the system, e.g. “what was last transaction?”
– Personal history, e.g. calendar entries
– Recognition of items user should be familiar with, e.g. own photo from a set of mixed ones
Computer Security ManagementPage 12
Security aspects of challenge-response pairs
• Guessing difficulty– low expectation for a successful guess within a small number of attempts
– answer should come from a uniform distribution – is this realistic?
• Observation difficulty– it should be difficult for an attacker to retrieve or observe the answer
– answers should not be available from public sources, e.g. social networking websites
– observation difficulty will differ for individuals, e.g. family, friends, colleagues or strangers
• Capture difficulty– Covert recording of answers
– How many recovery attempts does an attacker have to observe in order to launch a successful attack?
Computer Security ManagementPage 13
Questions
• Fixed– Administrator-chosen to Prevents choice of poor questions
• Open– User-chosen personally memorable content
• Controlled – Fixed set of questions but user can select and modify
– Often combined with hints
Computer Security ManagementPage 14
Answers
• Fixed – User chooses one answer from a set
– Common answers need to be barred!
• Open– Free form text
• Controlled– User-modified answer
– Format of answer is controlled
Computer Security ManagementPage 15
Challenge-response pairs
• Fixed-controlled
• Fixed-open
• Controlled-fixed
Computer Security ManagementPage 16
Comments
• Credential recovery systems need to be carefully planned and designed
• Infrequent usage– mechanism should be forgiving
– users may remember cues, but not details (e. g. word but not upper/lower case)
• Consider cost of setting up and maintaining system
• Currently text-based, but could involve photos or music
• Can be combined with other techniques, e.g. captchas