Are you in the process of reviewing your authentication procedure for your customers? Struggling to determine the most effective solution for your needs? Need top notch security but an easy experience for your customers? Look no further. We’re here to help.
We’ve liaised with our team of cyber experts, including the very credible cyptographer Dr Michael Scott, to come up with a shortlist of good things to consider as you do your research.
So, here are our seven ‘don’t forget to ask’ questions when considering the best authentication scheme to use… and hopefully these will help with your decision making process…
1. Is the authentication truly two factor?
On this point at least there is general agreement. Two factors are a lot better than one.It is easy to underestimate just how much harder it is for an attacker to solve two completely unrelated problems in order to achieve their malign ends, and the extent to which such a prospect demoralises all but the most persistent attacker. But each factor should be completely independent, and knowledge of one should not weaken the other.
2. Is the authentication solution immune to phishing attacks?
The simplest methods of authentication involve nothing more sophisticated than the simple handing over of credentials to a relying party, who then compares them with locally stored copies. Such schemes may involve PIN numbers, longer secrets, answers to security questions, photo IDs etc. A rather pathetic defensive elaboration might be to ask only for certain digits of a PIN or letters of a password. The details don’t really matter – all such schemes are wide open to phishing attacks. The victim clicks on a link and is socially engineered into giving up his/her secrets. The dodgy website on the other side of the link might even SMS you a passcode and get you to enter it to lull you into a false sense of security. Duh - You just gave away your credentials.
3. Does the authentication use cryptography?
Our Chief Cryptography Officer, Dr Michael Scott says: “It really should, and indeed it must to avoid phishing. The trick is that instead of handing over your credentials, you instead use those credentials to perform an operation, that you could only carry out if you do indeed possess those credentials. Like digitally signing a random challenge with a secret cryptographic key, and passing back the signature for verification (and not the key itself!). Remember attackers rarely - if ever - succeed by breaking the cryptography. It’s a tried, tested and reliable tool.”
4. Does the authentication require secure hardware on the client side?
Ideally not. Secure hardware may not be secure (and cannot simply be updated like software), it is expensive, and it may be backdoored. The security of the hardware extends our need to trust third parties, and unless the authentication protocol absolutely requires it, it is best avoided.
5. Does it store a vulnerable credentials database on the server-side that could be subject to a breach?
Servers need to verify that the client does indeed hold the claimed credentials. This suggests a need for the server to maintain and secure a database of information related to those credentials, with one entry per client. In the simplest cases this may be the actual credentials or a hash of those credentials. In more complex cases it may be a database of public keys associated with the private key held by the client. In all cases, it’s a security nightmare! Servers have proven incapable of protecting such credential databases from hackers. And irrespective of the scheme, if an attacker gains control over the credential database, the security of every client will be compromised.
6. Is it Help-Desk friendly?
“I forgot my password, I lost my token, I grew a beard, I have been issued with a new Photo ID, my mother changed her maiden name……” Low Help-Desk traffic and complexity is an important attribute of any authentication scheme, because your clients are only human and they forget and lose things. Any associated replacement costs should also be as low as possible.
7. Does it compromise your privacy?
Beware authentication schemes which require you to give up too much information about yourself. Your biometrics, your phone number, your email address. In the longer term you live to regret it! A randomly chosen password reveals almost nothing about you, and therefore sets a high standard for anything that may purport to replace it.
Only MIRACL Trust provides satisfactory answers to all of these questions. Genuinely two-factor, immune to phishing, based on solid cryptographic foundations, no secure hardware requirement, no credential database, very help-desk friendly, and respectful of the users privacy.
Find out more about MIRACL’s quick and user friendly Multi-Factor Authentication by visiting www.miracl.com or follow on social media: Twitter @MIRACL | LinkedIn MIRACL
