An interview with Bruce Schneier

http://www.simple-talk.com/opinion/geek-of-the-week/bruce-schneier-geek-of-the-week/

It is an interesting interview, but the words I would like to stress are:

RM: Do you think that two-factor authentication, or using methods in addition to passwords, could still be defeated by Trojan horses and phishing attacks?

BS: Of course; there isn’t even any debate. The debate is whether two-factor authentication will turn out to be useless in defending against identity theft because criminals will turn to Trojan horses and man-in-the-middle attacks.
It solves the security problems we had ten years ago, not the security problems we have today.

Despite all my involvement and effort in the past month studying and understanding 2FA, I have simply little or no faith in it. To me, it doesn't matter if it is 3FA or even 10FA. Once something get in between (MITM), that is the end. It is just a matter of more phishing attack to make the user enter or give up their inputs.

My primary concern is that people still does not see that the weakest link in a 2FA solution lies in the channel. And by channels, I do not mean the incoming channels (web + token, or web + handphone), this has to be applied to the outgoing channel as well. What type of security will we be talking about if you key in the multiple inputs all into the browser eventually and all we need is a poisoned proxy or a trojan BHO riding on the browser?

Does this mean I do not use internet banking? Probably not. However, it does help to minimize the risk of doing internet banking by taking more security measures.

2FA on the Windows Home Server - The Planning

I was talking about how I wanted to integrate the 2FA (two factor authentication) into my Windows Home Server. As luck may be, there is a third party plug available from:

TwoFactor WHS
http://twofactorwhs.codeplex.com/

I had evaluated it and concluded that it is nothing more than just changing the index.html on the web server actually. However, the biggest hurdle here is that the solution I wanted to integrate does not work with this plugin:

PhoneFactor
http://www.phonefactor.com/

According to a post. it is "suggested" to the developer by probably another developer from PhoneFactor to integrate this:

http://twofactorwhs.codeplex.com/Thread/View.aspx?ThreadId=61471

Looks like its more work for me. I probably have to to some work to get PhoneFactor working.

Ok, let's take a look why I want to use PhoneFactor.
Firstly, its using Phone as a authentication mechanism, which is OOBA (Out-Of-Band authentiocation). This word is going to get even more popular soon than 2FA. Because ultimately, traditional 2FA (SMS, token etc) still uses the same channel (application, web) to perform the second level authentication. However, PhoneFactor uses the phone. It is kind of a IVS actually. But I never said this require a very complicated solution.

So, secondly, PhoneFactor actually offers a pack for 25 users for FREE. And this fits nicely into WHS, because the cap for the WHS is only 10 users.

Thirdly, it offers FREE calls in some countries listed here:
http://www.phonefactor.com/products/global-services

And well, ok, my country is listed here. So, it is much more cost saving. Actually, to be honest, if I had to pay a cent for 2FA, I probably wont even think about it.

Lastly, it is token free. This is just not so handy (and costly) to have a token etc. The phone, I always have with me.

So, after kinda "selling" for PhoneFactor, maybe you are also interested to try it out for some of your application and share your experience?

2FA on the Windows Home Server

With the banks and everyone else tightening up the authentication, it is also no surprise that people like me is also looking at a 2FA solution that log in to my WHS. I had chosen one of the out-of-band solution using the mobile phone. As I see it, this should be the way moving ahead.

I won't say too much about how it is done yet as I am still looking at the implementation, but it is likely I will roll this out this coming weekend and as such all login to the WHS will be disrupted and no longer valid until you have register you handphone with me. :)

I will share out the experience after I complete this exercise.

Evolution of Banking

I had seen how banking is evolving but is really kinda worried at the latest stage this is getting to... Lets take a look at the cycle :

Paper Banking -> ATM Banking -> Phone Banking -> Internet Banking -> Home Banking

What is home banking? Well, its something you can only do at home and not elsewhere. Why? Because we need a 2FA token now. this 2 factor authentication token is small, but would someone carries like a whole bunch of them, one for each bank? No, not me. I have a few and they all stay at home. no more banking in the office, banking at Macdonald (btw, that is so the wrong thing to do) and banking at Microsoft. I can only bank at home now.

This is certainly not a step forward. Some bank tries to overcome this by giving a mobile phone option which is much better. Otherwise, I really hope they can sit down and unify the token instead. There is just not enough common sense to assume people will carry all the bunch of token all around.