cryptoparty @hsgr

1. Two Factor Authentication
cryptoparty @hsgr
by ebal
1

2. How am I ?
●
http://ebalaskas.gr (blog/wiki)
●
@ebalaskas twitter/identica
●
plz interrupt during this awesome talk
●
this presentation has only 8 pages!
2

3. Whats the problem ?
●
My Pin/Password is: 123456
●
My Pin/Password is: r(>X5^&3Z*;evqxJ9&=1$
●
Login Site saves passwords cleartext or unsalted
●
Login Site is not over httpS
●
This isnt my PC !
●
This is a public network
●
I use my android/iphone/etc
3

4. What is the ideal ?
●
Different Passwords for different accounts !
–
–
●
●
●
Predefined list ?
Sync ?
Could i use something that i dont have to type ?
Is it possible to use something i have and
something to type ?
Is it possible the password changes automaticaly
every minute?
4

5. Do i need to use my eye ?
●
Yes and No
–
you can use biometrics but do you really want to
put your eye/finger to a hole?
●
Crypto­tokens
●
ibuttons
●
Smart cards (bank cards)
●
Usb (yubikey)
5

6. hardware
6

7. Plz tell me some acronyms
●
OTP
●
RFC 2289
●
OTPW
●
http://www.cl.cam.ac.uk/~mgk25/otpw.html
●
HOTP
●
RFC 4226
●
TOTP
●
RFC 6238
A One-Time Password System
● A one-time password login package
● An HMAC-Based One-Time Password Algorithm
● Time-Based One-Time Password Algorithm
●
7

8. Questions ?
http://gr.linkedin.com/in/evaggelosbalaskas
8