Hacker News Reader

Comment by chayesfss | Hacker News Reader

We use this concept for low friction enterprise authentication at SecureAuth. Sure as hell beats rsa tokens or anything related to a phone.

View on HN

What? Wow, that sounds really dangerous. The same fingerprint is available to any site out there, so anyone could just capture it and try to replay it on a "SecureAuth" service, no?

Here's how it works. As a user I want to connect to a web resource, I am redirected to my idp (SecureAuth) where we ask you your name, then I look at your account and ask you to enroll, then I ask you your password. Now before I generate a claim/token or what ever I take your fingerprint so for the next day/30 days/90 days or what ever your fingerprint is checked between your username/password and the strong authentication is transparent to the user. The variables can all be weighted differently and the fingerprints can easily be revoked but it is very cool technology.

Hopefully that isn't the only mean of authentication.

What is it then? What if I upgrade the browser, will it accept whatever other auth factor I present (a password?) anyways? What's left then?

I also used a similar concept to help us investigate charges of of cheating in an asynchronous online strategy game where sock-puppet collusion would destroy the balance. Having an extremely high probability that two accounts are actually the same browser made it easier for us to warn|block|ban cheaters.

Could you explain how it would work?

The user signups up, connects their phone to their account and you use the fingerprint as the ID for future validation?

How do you handle changes in fonts/plugins/browser versions/timezones while travelling.

All of that data seems to be muteable over time. Unless it's a 99% match kind of thing. Also what about companies that hand out laptops with the same base OS/browser-installs (or is that the goal)?

Client side changes are handled in a weighted model. If the heuristics match between 85 and 95% we might update the stored fingerprint. While we can use this for SSO it's usually tied to another factor of authentication. Something like a user/pass, social id or maybe saml assertion from another claim provider. We are just scratching the surface of what this type of technology can be used for.

sounds awesome and at the same time it's shocking how unique and identifiable we are online. Did you consider adding _buzz_and_words_here_ 3-Factor Auth (4-Factor for Gov. clients)? You could solve it in a way that makes it very comfortable to the user, yet very hard to crack for crackers.

    1. Your Tracking Technique + DRM-based-License Tracking
    2. One Password / ID (No username required, it's optional)
    3. Typing Speed Tracking 99.5 percent accuracy [1]
    4. (Bio-metric Data like Fingerprint or HD Iris Scans for Gov. Clients)

DARPA is also working on it, definitely watch this (Google alredy uses this!):

http://www.youtube.com/watch?v=fgNpOzvwOiU

[1] http://csis.pace.edu/~ctappert/it691-08fall/projects/keystro...

Dude, you made me curious, I will implement this after my thesis! :)

(I'm watching you DARPA et. al /24/7/365!)

Yeah we provide the solution to a lot of government clients. Strange enough, our international clients like the 3 or 4 factor authentication. It's very very easy for us to do though as there's no limit to chaining the work flows together.

Can you already offer 3. as a service, is it in planning, or won't you use that?

Yes, 3, 4, what ever they want we already offer

Reply on news.ycombinator.com