Computer Security Management(ISYS20261)Lecture 14 – More on Passwords Module Leader: Dr Xiaoqi Ma School of Science and Te...
Last week …• Passwords• PINs• Challenge-responseComputer Security ManagementPage 2
Today• Captchas• Graphical passwords• How to recover a forgotten passwordComputer Security ManagementPage 3
Captchas (1)• Completely Automated Public Turing test to tell Computers and  Humans Apart (von Ahn, Blum, Hopper and Langf...
Captchas (2)• Sequence:                                           System                                         request  ...
How to crack Captchas• Human operators (“Sweatshop”)• Forward captcha from original site onto attackers web site and let  ...
Graphical authentication• Human memory for images is better than for words• New approach: graphical (image based) authenti...
Password recovery• Passwords are often forgotten  – Infrequent use  – Forced change (due to password policy)  – etc• Passw...
Credential recovery• User-triggered process to reset forgotten passwords• Uses knowledge-based authentication• Two varieti...
Recovery with enrolment• Users enrol set of challenges and responses• On re-set they have to prove their identity by answe...
Recovery without enrolment• Probing knowledge shared between system and user:  – Probing recent interactions with the syst...
Security aspects of challenge-response pairs• Guessing difficulty  – low expectation for a successful guess within a small...
Questions• Fixed  – Administrator-chosen to Prevents choice of poor questions• Open  – User-chosen personally memorable co...
Answers• Fixed  – User chooses one answer from a set  – Common answers need to be barred!• Open  – Free form text• Control...
Challenge-response pairs• Fixed-controlled• Fixed-open• Controlled-fixedComputer Security ManagementPage 15
Comments• Credential recovery systems need to be carefully planned and  designed• Infrequent usage  – mechanism should be ...
Upcoming SlideShare
Loading in …5
×

Isys20261 lecture 14

199 views
141 views

Published on

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
199
On SlideShare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
5
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Isys20261 lecture 14

  1. 1. Computer Security Management(ISYS20261)Lecture 14 – More on Passwords Module Leader: Dr Xiaoqi Ma School of Science and Technology
  2. 2. Last week …• Passwords• PINs• Challenge-responseComputer Security ManagementPage 2
  3. 3. Today• Captchas• Graphical passwords• How to recover a forgotten passwordComputer Security ManagementPage 3
  4. 4. Captchas (1)• Completely Automated Public Turing test to tell Computers and Humans Apart (von Ahn, Blum, Hopper and Langford, 2000)• Challenge-response test to ensure that the user is a human – E.g. to prevent automated account harvesting• Captcha is a computer generated puzzle, i.e. a distorted image of a number/character sequence• User has to type in the number/character sequence• Most humans can read the image but current software can’t• Examples:Computer Security ManagementPage 4
  5. 5. Captchas (2)• Sequence: System request "squestra" authenticated • Problems: – Blind or visually impaired users? – Mobile devices with limited hardware capabilities?Computer Security ManagementPage 5
  6. 6. How to crack Captchas• Human operators (“Sweatshop”)• Forward captcha from original site onto attackers web site and let users unwittingly solve the puzzle! (in real time) Attackers System web site request to logon to Attackers free site request to logon to protected site "squestra" "squestra" authenticated authenticatedComputer Security ManagementPage 6
  7. 7. Graphical authentication• Human memory for images is better than for words• New approach: graphical (image based) authentication• Graphical passwords – Recognition based – User to select picture among a set of distractors – Example: PassFaces• Position based passwords – Click on right region on an image (challenge) – Chose the correct pattern – Example: GrIDsureComputer Security ManagementPage 7
  8. 8. Password recovery• Passwords are often forgotten – Infrequent use – Forced change (due to password policy) – etc• Password (credential) needs to be recovered• Easy option: send me a new (or my old) password via email• Not really secure!• Need for authentication• Better option: challenge-response based recoveryComputer Security ManagementPage 8
  9. 9. Credential recovery• User-triggered process to reset forgotten passwords• Uses knowledge-based authentication• Two varieties – Answering enrolled challenges – Recovery without enrolmentComputer Security ManagementPage 9
  10. 10. Recovery with enrolment• Users enrol set of challenges and responses• On re-set they have to prove their identity by answering challenges• Issues – Which challenge-responses should be used? – Who chooses them?Computer Security ManagementPage 10
  11. 11. Recovery without enrolment• Probing knowledge shared between system and user: – Probing recent interactions with the system, e.g. “what was last transaction?” – Personal history, e.g. calendar entries – Recognition of items user should be familiar with, e.g. own photo from a set of mixed onesComputer Security ManagementPage 11
  12. 12. Security aspects of challenge-response pairs• Guessing difficulty – low expectation for a successful guess within a small number of attempts – answer should come from a uniform distribution – is this realistic?• Observation difficulty – it should be difficult for an attacker to retrieve or observe the answer – answers should not be available from public sources, e.g. social networking websites – observation difficulty will differ for individuals, e.g. family, friends, colleagues or strangers• Capture difficulty – Covert recording of answers – How many recovery attempts does an attacker have to observe in order to launch a successful attack?Computer Security ManagementPage 12
  13. 13. Questions• Fixed – Administrator-chosen to Prevents choice of poor questions• Open – User-chosen personally memorable content• Controlled – Fixed set of questions but user can select and modify – Often combined with hintsComputer Security ManagementPage 13
  14. 14. Answers• Fixed – User chooses one answer from a set – Common answers need to be barred!• Open – Free form text• Controlled – User-modified answer – Format of answer is controlledComputer Security ManagementPage 14
  15. 15. Challenge-response pairs• Fixed-controlled• Fixed-open• Controlled-fixedComputer Security ManagementPage 15
  16. 16. Comments• Credential recovery systems need to be carefully planned and designed• Infrequent usage – mechanism should be forgiving – users may remember cues, but not details (e. g. word but not upper/lower case)• Consider cost of setting up and maintaining system• Currently text-based, but could involve photos or music• Can be combined with other techniques, e.g. captchasComputer Security ManagementPage 16

×