Conspicously absent: social engineering and cross-domain problems

There's another aspect to this security problem that it conspicuous by
it's obvious absence - people have multiple logins everywhere - most
people using the same password on all of them.  Phishers don't need to
hack or spoof PayPal to steal peoples money - they just need to hack
or spoof anywhere else victims frequent, or even run any site that
asks them to legitimately create an account (eg: blogs,
software/movie/mp3 download sites, whatever) - chances are the victim
will give their PayPal credentials that way anyhow.  We don't just
have to protect victims against malicious phishing attacks etc - we
also have to protect them against their own stupidity.

And "stupidity" isn't obvious - I listened to my dad telling the phone
company his date of birth when they phoned his cell to offer him some
telco reward scheme - after he finished the call, I told him it could
have been anyone phoning him - not just the phone company - and I said
he was stupid to tell them his birthday.  Besides the fact he
volunteered the info without question, he did not agree with me that
it was stupid to tell them.  I bet he'd probably have told them his
PIN number after they offered whatever discount sounded good, and I
know his PIN is the same on his phone, email account, and home alarm for
sure - I bet it's probably the same on his ATM cards too.

A *really* **good** authentication scheme not only solves the
relying-party-must-authenticate-to-user problem, but ALSO solves the
stupid user problem too.

Kind Regards,
Chris Drake

Received on Monday, 12 June 2006 14:53:06 UTC