Main Area and Open Discussion > Living Room
Why aren't we using public-key cryptography instead of passwords on the net?
f0dder:
I type the passphrase in once, when i boot up my machine. The private key is unlocked for the rest of the session, and it's used automatically when i connect to any server that has the corresponding public key. Logins are instant and seamless; i log in and out of stuff all day long.
--- End quote ---
And if public-key crypto became widespread, do you know what would happen? Yes, indeed, trojans attacking the keystore. If you keep the keystore authenticated all day, the encryption keys sit in memory all day, and every major OS has privilege escalation attacks that'll allow you to get at those precious bits.
Even if i connect to server A, and then hop from there to server B, i can defer all the key-checking back to my desktop. Server A doesn't need to have my private key on it to connect somewhere else in my name.
--- End quote ---
I really, really, really hope he only does that through servers he has 100% trust in. If server A gets compromised, funny things can happen to ssh agent forwarding.
But yes, all in all, good points - I certainly do prefer pubkey authentication to servers. (Oh, and remember not to use the same pubkey for everything).
Stoic Joker:
I realize that encryption has its place in the scheme of security, But... I really thing it's overused as a magic bullet solution to the wrong problem. Computers today have the capability of spitting out thousands of password attempts per second ... And this is assumed as a complete justification for concocting passwords that are complex enough that (nobody can remember them) they will take "reasonably" close to a million years to guess. And the race begins...
Why...
Seriously, why even bother (joining the race) ... The computer can spit out x thousand attempts per second, which becomes completely and instantly irrelevant when a lockout policy is enabled. 5 attempts in a minute = locked out for x minutes. How successful is brute forcing against that scheme?? ...My guess is not very.
Deozaan:
Seriously, why even bother (joining the race) ... The computer can spit out x thousand attempts per second, which becomes completely and instantly irrelevant when a lockout policy is enabled. 5 attempts in a minute = locked out for x minutes. How successful is brute forcing against that scheme?? ...My guess is not very.
-Stoic Joker (December 06, 2011, 06:48 PM)
--- End quote ---
Brute forcing isn't the only way to get someone's password. There's also phishing and other social engineering.
If all you relied on was a lockout policy and had something simple like "password3" as your password on every site you visited, that's still not very secure. Even if your password wasn't so stupid, a single breach on one site means all your accounts on all other sites are breached.
You'd still want a nice strong password that makes it hard to guess. Part of being a "nice, strong password" is that it isn't the same one for multiple sites/places. The hard part about having nice, strong passwords that aren't the same one on multiple sites is remembering them all. Hence public-key cryptography where you have a single nice, strong password the protects your private key which (if I understood it correctly) is then used to make a (bunch of) public keys which are each like nice, strong passwords that are hard to guess even with the lockout policy.
Stoic Joker:
Seriously, why even bother (joining the race) ... The computer can spit out x thousand attempts per second, which becomes completely and instantly irrelevant when a lockout policy is enabled. 5 attempts in a minute = locked out for x minutes. How successful is brute forcing against that scheme?? ...My guess is not very.
-Stoic Joker (December 06, 2011, 06:48 PM)
--- End quote ---
Brute forcing isn't the only way to get someone's password. There's also phishing and other social engineering.-Deozaan (December 06, 2011, 09:05 PM)
--- End quote ---
Which could also net the attacker the key ... No door is secure enough if "Knock Knock" works. But I leave that part up to Charles Darwin...
If all you relied on was a lockout policy and had something simple like "password3" as your password on every site you visited, that's still not very secure. Even if your password wasn't so stupid, a single breach on one site means all your accounts on all other sites are breached.-Deozaan (December 06, 2011, 09:05 PM)
--- End quote ---
Agreed, no single layer is absolute ... I just get tired of all the stress being put on encryption. It does have its place but t's not a magic bullet, and sometimes simple really is best. Solutions that is, not passwords. The pass phrase idea I've always liked ... 25 character random strings is just begging for trouble.
You'd still want a nice strong password that makes it hard to guess. Part of being a "nice, strong password" is that it isn't the same one for multiple sites/places. The hard part about having nice, strong passwords that aren't the same one on multiple sites is remembering them all. Hence public-key cryptography where you have a single nice, strong password the protects your private key which (if I understood it correctly) is then used to make a (bunch of) public keys which are each like nice, strong passwords that are hard to guess even with the lockout policy.-Deozaan (December 06, 2011, 09:05 PM)
--- End quote ---
A single point is a single point, the key can get accessed ... Especially if it a high value item. And if one needs to make it portable. Well... It either going to be memorable, or written down. Which take us right back to the getting hacked by the cleaning lady (I love that one).
Renegade:
The pass phrase idea I've always liked ... 25 character random strings is just begging for trouble.
-Stoic Joker (December 06, 2011, 10:28 PM)
--- End quote ---
+1 for that!
Navigation
[0] Message Index
[#] Next page
[*] Previous page
Go to full version