Information Systems and Internet Security
This is a short rant prompted by another student’s observation that Yelp actually asks for your Gmail password as part of their signup process…
Have you encountered a website that asks for the username and password to your e-mail provider? I’m talking about this:
Short Summary of the paper:
Draw a Secret- DAS is a graphical password scheme where users are suppose to draw a secret on a grid. A completed drawing, i.e., a secret, is encoded as the ordered sequence of cells that the user crosses whilst constructing the secret. Each time a user lifts the en from the drawing grid surface, a “pen-up” event is encoded by distinguished coordinate pair. Here the important thing to note is even if the shape are not same as long as the encoding is identical it will yield to the same password. The basic problem with this scheme is it is vulnerable to graphical dictionary attacks. Also, users tend to choose passwords which are symmetrical and centralized. Therefore in this paper, authors proposed to use a background image to help users 1)remember the password more easily 2)set none symmetrical or none centralized passwords. The only difference here, users are not drawing their passwords onto an empty grid, but they are choosing a background image to draw on it as well. Experimental results show that this scheme is better than DAS since people chose more complicated and longer passwords. Also symmetry and centralization was lesser for this scheme, therefore authors concluded it is more secure than DAS. However the question arises here : introducing background images may give the attackers clue about the password. So can security reduction caused by this background images be compensated by reduced symmetry and centering? Unfortunately in the paper there is no study about this question. It is an open problem!
Questions arised in the meeting:
Single Site Browsers [to be uploaded later]
It’s an interesting idea and I can’t disagree with the concept (<3 <3 separation of privilege) but I think it’s missing a few things. Here are some observations I made about it.
Still, it’s kind of cool.
Late last year in an article titled “In Zombies We Trust,” Dan Geer suggested that there are two types of users — those who blindly say yes to everything and are probably infected with a dozen viruses and those who say no to most everything and likely escape most virus problems — and that it could be a legitimate practice for websites to further scrutinize the actions of those who always say yes to prevent them from getting into trouble while using their site. The premise is that these virus-infected users end up costing the businesses they frequent a significant amount of money by being such persistent problems.
A member of our lab (I’ll leave it to him to take credit for this idea) suggested last week that maybe this should be taken a step further. If I know that one customer of mine is more likely to be infected with a virus (or has a higher susceptibility to phishing, pick your threat) now or in the future, is it reasonable for me to completely deny him my business?
This can be easily tested using either Dan Geer’s test or by sending my customers random phishing messages for my own business (there’s even a phishing appliance to do it for you!). Ie., Paypal sends you a phishing email for themselves (sent from another domain, self-signed certificate, graphics copied incorrectly, differently formatted e-mail, whatever) and if you fall for it, they calculate your future profitability and weigh it against the costs you’ll incur if you actually do get phished in the future. If you’ve got a negative balance after this calculation, your account will be canceled and PayPal will have saved money.
The observation was also made that this is standard practice in other industries. Insurance and, regrettably, healthcare come to mind. Would this be a bad thing for web services?
Loading … Loading ...
Recent Comments