It is now universally acknowledged that basic password authentication
does not offer sufficient security. 2-Factor authentication is a major
improvement and hopefully would become the standard form of
authentication over time.
Another approach that might work well would be to use public key cryptography to authenticate with a signed password instead of just the plain password.
An application (web or native) would generate the public/private key pair and store the private key locally while storing the public key along with the user's password on the server. This key generation can happen for instance during account sign up when it is clear the owner of the account is the one accessing it. Of course a key rotation mechanism can be devised to allow for a flexible way of rotating keys. This would all be transparent to the end user.
Instead of the user submitting just the password, they'll submit both the password and a timestamp based signature, ie plain password+current timestamp. This signature would be generated by the locally stored private key. For instance a developer could simply add Javascript to a login page that would generate the signature using the private key stored in the browser's local storage.
This can be implemented easily both for native and web apps without any complication to the sign-in process for the end user.
On the server, authentication would need to be tweaked of course, but the additional effort is minimal. On platforms like php it is just a matter of updating the authentication logic, on JVM platforms application servers can bake this in as an additional security option and make it easy to configure.
On the server, the signature would be verified using the stored public key and the user can be authenticated. Authentication can be denied perhaps based on some sort of user preference. For instance a user could specify that if they ever attempt to access their account without a valid signature, the server should deny access. Or a user could say if signature verification fails, failover to 2-factor authentication.
This can be of course combined with 2-Factor authentication. Also a process can be developed to make it easy to transfer the locally stored private key to other devices both permanently or temporarily.
Of course private keys could be stolen via other security weaknesses but this seems like a low hanging fruit approach to mitigating the effect of stolen passwords and brute force attacks on weak passwords, thereby significantly increasing the effectiveness of passwords.
At the end of the day, security is not about one perfect solution but rather a combination of solutions that together lead to an effective solution.
Just some thoughts...am I missing something here?
Another approach that might work well would be to use public key cryptography to authenticate with a signed password instead of just the plain password.
An application (web or native) would generate the public/private key pair and store the private key locally while storing the public key along with the user's password on the server. This key generation can happen for instance during account sign up when it is clear the owner of the account is the one accessing it. Of course a key rotation mechanism can be devised to allow for a flexible way of rotating keys. This would all be transparent to the end user.
Instead of the user submitting just the password, they'll submit both the password and a timestamp based signature, ie plain password+current timestamp. This signature would be generated by the locally stored private key. For instance a developer could simply add Javascript to a login page that would generate the signature using the private key stored in the browser's local storage.
This can be implemented easily both for native and web apps without any complication to the sign-in process for the end user.
On the server, authentication would need to be tweaked of course, but the additional effort is minimal. On platforms like php it is just a matter of updating the authentication logic, on JVM platforms application servers can bake this in as an additional security option and make it easy to configure.
On the server, the signature would be verified using the stored public key and the user can be authenticated. Authentication can be denied perhaps based on some sort of user preference. For instance a user could specify that if they ever attempt to access their account without a valid signature, the server should deny access. Or a user could say if signature verification fails, failover to 2-factor authentication.
This can be of course combined with 2-Factor authentication. Also a process can be developed to make it easy to transfer the locally stored private key to other devices both permanently or temporarily.
Of course private keys could be stolen via other security weaknesses but this seems like a low hanging fruit approach to mitigating the effect of stolen passwords and brute force attacks on weak passwords, thereby significantly increasing the effectiveness of passwords.
At the end of the day, security is not about one perfect solution but rather a combination of solutions that together lead to an effective solution.
Just some thoughts...am I missing something here?
You are missing that this locally stored private key is not easily transferred to other devices or browser, prohibiting users from logging in from another browser/device.
ReplyDelete