Comment by ChuckMcM | Hacker News Reader

Comment by ChuckMcM | Hacker News Reader

Parent Full thread

Of course I'm serious.

How does the service know that you're in possession of the key unless you give it some kind of input about the key that's unique to the key and to the current time?

Lets say you've got a 'fob' which is plugged into a USB port. Application sends the fob a challenge, fob responds. Application validates the response and proceeds. Perhaps the key uses 2.4mhz wireless, perhaps it uses bluetooh (a protocoled 2.4mhz wireless solution :-). The benefit is that these things can only occur when you're key is present. No key, no transaction.

We don't worry about Nigerians stealing our cars, but we should consider what they might do with our self-driving cars if we don't have some durable way to say we're in the car right now.

I appreciate that you prefer having something like this on your smart phone, but such a solution fails for the larger internet population. And while SMS works for 'dumb' phones you cannot have it validate on every send, every post, every tweet, every page view.

You may not share my urgency on this as a threat but I invite you to start to watch more closely. In the Atlantic article a Google representative said "Thousands per day" this is big business for folks. I was talking with a senior executive at Wells Fargo who mentioned hundreds of millions of dollars 'lost' every year. This is a growing problem, its getting more expensive, and like some digital herpes my expectation is that it is going to pop out suddenly in boils of financial putritude dripping pain, financial suffering, and expense for everyone involved. With luck we'll fix it before then but most folks who are getting burned are more interested in covering it up rather than addressing it sadly.

I think it would be wonderful to have a possible solution prototyped and demonstrable for people in pain. Your passwords will be compromised, and if you do anything financial online you will have money vanish and you will experience arguing with a bank as to why they should give it back to you and take the loss. This isn't a 1 in 10, or 3 out of 5 type statistic, I'm pretty confident that every single person who has an online account which can tranfer funds (whether its an iTunes account or a checking account) will experience this. 100%.

> Lets say you've got a 'fob' which is plugged into a USB port

I still fail to see how this solves anything. Once you get malware on your computer, that malware can send requests to the USB device, and you're back at square one.

One of the features of RSA security fobs is that only someone physically present can use it. What you've made is an RSA fob that's vulnerable to viruses.

The protocol between the service and the FOB allows for any program sitting on the computer to snoop the entire exchange and be unable to reproduce it. The simplest example of this was the Millicent protocol which used an MD5 running backwards as a one time pad, although that had other issues.

But lets say that at the 'introduction' stage the service set a cookie with the fob by saying 'remember this about me, I'll call my self ecb994af and your magic number is 3551eff' then later on verification passes it sends a message encrypted by its self key to 'tell me your magic number divided by 2 and encrypted with your id.' The attacker can see the whole sequence but if they don't understand what is being asked and returned they can't reproduce it, and they don't have the initial secrets either.

There are lots of ways to do this with smart protocols. Something I tried (and failed) to patent back in the Java days where you sent a packet which could be executed. The nice thing about such protocols is they can be dynamically designed between device and service and malware is stuck out in the cold.

There are things it cannot protect against, malware running in the Google servers or Amazon's for that matter which has access to all of their server data. But if it does get compromised it only compromises one relationship, no additional damage is done because other systems can have their own protocols, their own dynamic data.

For this to work, you'd need a trusted connection between the fob and the server. So this reduces down to relying on a CA system, which first of all isn't open, and second we now know works very poorly. Heck and on the USB device you wouldn't even have a secure way to able to update the CA store to remove bad actors.

If the fob is issued by the company that runs the server, the company can put keys into the fob before they mail it to you. No CAs needed.

The problem I see with this solution is that it would require a plugin to be installed on your browser in order for the browser to have access to the fob. This alone is enough to discourage a lot of people from using it.

Also, you wouldn't be able to log into a public terminal.

He seems to be advocating that the solution is built into all levels of the stack: OS drivers, native browser support (i.e. no plugins), etc.

Using a TPM to ensure that only trusted software is accessing the fob as well. We're still a little ways off from a completely cryptographically secure software stack.

In the ideal world, the spec would be open and anyone could implement it in their service (be it a browser or other). For most operating systems we're talking about something that looks like a device connected over a serial port. The Android service is pretty straight forward and I've played a bit with ideas on an old G1 which had a serial port hidden in the USB port, not sure about iOS. Computers like laptops etc its very straight forward (for both wireless and wired solutions).

"Also, you wouldn't be able to log into a public terminal."

Actually depending on capability (no pun intended) I could easily see 'read' access being usable without the key but recognize the issue there. The real 'issue' if you will is universal appeal/buy-in which is to say if anyone can use it then you will get some early adopters who will provide support as a differentiating factor and that can drive adoption into more slowly changing markets. Because it has to be everywhere to be effective it won't be a big money maker (this is where a lot of VCs stop listening :-) basically the barrier to implementing it has to be 0 and the value to the implementor has to be non-zero. Given how thinly marginallize 'security' fixes are, this margin won't leave anything for the manufacturer in terms of on going revenue so the key itself has to define the value for the company. (I've actually thought a lot about this :-)

So to your point, for early adopters the experience would be to get a 'key' and to install a plug-in and then enabled sites and services would be secured. Pretty easy sell to an enterprise if their only cost is the 'fob cost' and there isn't some giant consulting revenue stream attached to it. For big companies it has to be completely implementable (once the key infrastructure is set up) in a way that is custom (and probably private) that enterprise. That gives their IT folks confidence and it makes the risk low.

For more general engagements like PayPal or Facebook its a bit different. On things that are appifyable (if that makes sense) there is a potential for differentiation (look at how the World of Warcraft Authenticator stuff was worth it for them to implement).

The key for me is that the existing way of doing things is under attack and it will eventually succumb, when it does there is a tremendous opportunity there.

This sounds like a lot of necessary infrastructure. Widespread smartphone adoption seems more likely to me.

Yubikeys (yubico.com) get part of the way there, with the USB plug part anyway.

ObDisclaimer: not a representative of, etc, just messing around with them at the moment.

I have one of those and it was very inspiring in my thoughts on this. I agree it comes part of the way there.

Reply on news.ycombinator.com