On Thu, 26 Mar 2009, Leif Nixon wrote:
"Robert G. Brown" <[email protected]> writes:
But that's simply controlling the incoming client, and I AGREE
that this is what one has to do to make ANYTHING secure. Now
demonstrate to me any additional advantage to using yubikeys, secureids,
or anything else you like over simple ssl or ssh bidirectionally secured
unspoofable unsnoopable connections with no password at all.
Well, some banks over here have a authentication system that uses a
hardware crypto token with a keypad. You use it for a challenge-response
procedure to log in to the Internet banking site - nothing new so far -
but you also use it to sign (using challenge-response) each bunch of
transactions you perform on the banking site. And - this is the key
point - to sign the transactions you actually enter certain parts of the
transaction data (like the total amount to transfer) into the crypto token.
Even with total control over the client PC, it's real hard for an
attacker to do anything really evil in that setting.
I agree. Of course, what you're saying is that the actual transaction
agent is the token, and the token is separate and secure. The PC is
already a part of the external network back to the trusted host. I
stand corrected (sort of) for this exception, although it is really just
an example of a perfectly controlled transactional client (and the PC
itself is no longer really the client).
rgb
--
Leif Nixon - Systems expert
------------------------------------------------------------
National Supercomputer Centre - Linkoping University
------------------------------------------------------------
_______________________________________________
Beowulf mailing list, [email protected]
To change your subscription (digest mode or unsubscribe) visit
http://www.beowulf.org/mailman/listinfo/beowulf
Robert G. Brown http://www.phy.duke.edu/~rgb/
Duke University Dept. of Physics, Box 90305
Durham, N.C. 27708-0305
Phone: 1-919-660-2567 Fax: 919-660-2525 email:[email protected]
_______________________________________________
Beowulf mailing list, [email protected]
To change your subscription (digest mode or unsubscribe) visit
http://www.beowulf.org/mailman/listinfo/beowulf
