[Cryptography] Passwords: Perfect, except for being Flawed

[Natanael]

Den 23 feb 2015 00:21 skrev "Rob Meijer" <pibara at gmail.com>:
>
>
>
> 2015-02-19 17:18 GMT+01:00 ianG <iang at iang.org>:
>>
>> On 18/02/2015 17:21 pm, Kent Borg wrote:
>>
>>> The human is part of the security system.
>>
>>
>> Odd thing to say ;)  Security means nothing outside the context of a
human.
>>
>>
>>
>> As a meta-comment on passwords:  there is a big shift underway now to
start doing dual factor using the person's phone.  It is now clear that
everyone has a phone, to some statistical certainty, and we can rely on
it.  So every system and his dog has now migrated to using something to
couple the phone and the password together.
>>
>> (In the meantime, while this Phone+password hybrid rolls out, others
have gone further.  ApplePay, bitcoin light clients, my stuff, are putting
the whole thing on the phone.  So, actually we are exposing the phone to
single points of failure/attack modes.  But this direction is still so
novel and so far rare that there is no economic case for attack and won't
be for a few years...)
>>
>> Which is to say, micro-re-designs of how passwords work and can be
improved might be missing a macro-trend that is going on.
>
>
> ​Interesting. An other possible way to look at mobile phones could be as
a large keyring with (pseudo) anonymous​ keys. So rather than using the
phone as single token for proving identity, it could be a granular tool for
proving our 'specific' authority. If all the authority can be revoked all
at once by a caretaker we control from our home, we could simple revoke all
of our phone's authority if ever we lost it or it got stolen.
>
> Passwords are both (poor) tokens of authority and (poor) tokens for
proving identity. Two factor authentication makes for better tokens for
proving identity, but kills the (useful)  tokens of authority property that
allows us to share a password in order to delegate authority. If we can
manage to minimize the need for  tokens for proving identity and use tokens
for proving authority (capabilities) instead, than mobile phones could be
an interesting carriage for such tokens if we manage to get access control
on these devices sufficiently locked down to allow individual apps to keep
these authority tokens secret from each-other.
>
> A mobile phone as secure capability wallet. Would be an interesting
project to work on ;-)

Remarkably relevant: http://www.zurich.ibm.com/idemix/

Anonymous credentials. They're implementing credentials wallet software as
part of the project, including for smartphones. Allows you to prove that
arbitary statements about yourself are true (if the verifier trusts your
credentials issuer).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20150223/92f616c6/attachment.html>