Blog
Basic problems related to logging in
Logging consists of several stages, but to what extent are we able to really use them well? How much do we believe in logging in without evidence and what are we really able to solve?
Identification, authentication and authorization
Authentication is the basis of trust, because the assignment of rights presupposes adequate authentication of users. Without this authentication, the assignment of rights makes no sense, it would provide authorization beyond trust. And if we don't trust someone, why should we give them any information? For this reason, it is necessary to understand how authentication works. Therefore, identification is at the beginning of authentication.
Identification and its explanation
Identification describes the process by which the applicant for a login declares himself to be a person. In reality, the closest thing to this process is the form of a performance. Thus, a person announces that he or she has a name (he or she identifies himself or herself). Now he or she still has to prove it, this is what authentication does.
Authentication and its explanation
Authentication is significantly more complicated. The applicant is authenticated by the system to which he or she is logging. This can have different ways and has a lot of limitations, which this article will address. The authentication is usually based on some non-public knowledge, properties or possession of the device. In reality, it is possible to imagine authentication by a password, i.e. a shared secret, the same way as when classmates meet years later. They do not have to know each other, but they have shared memories of school years. These can work the same way as a password. In everyday life, the memory of an encounter can also be reminded by a voice and other "biometric data", but in the case of computers, their informational value is low. Only by proving the authenticity of the given identity can we solve the assignment of corresponding rights.
Authorization and its explanation
Authorization is the last part of the triad. It ensures the assignment of rights to the
applicant, who correctly proved himself or herself, i.e. proved to the system the authenticity
of the information provided. Subsequently, the system grants the applicant rights to access
the information offered. Transferred to a life example, you will discuss stories from school
and news from your life with a former classmate or classmate. But you will probably not treat
a random acquaintance in this way.
Currently, the effort is to ensure the minimum necessary permissions when assigning rights,
the so-called LUA (Least User Access or Least-privileged User Account). The so-called RBA (Role
Based Access) is usually used for the assignment of rights, as well as other methods (MAC,
DAC ...). But about these at some other time, as well as problems with managing access to
information.
Problems of authentication against the service
So far, it all seems reasonable, but is it that simple? If we look at the authentication itself more closely, problems begin to appear. As stated, the applicant (user) is authenticated against the server. But against which server? Is this server authenticated? It is not always so. At present, there are nearly two hundred authentication mechanisms available, some of these mechanisms are supported by dozens of algorithms. A large part of them are more than a few decades old. They were certainly not created on the basis of criteria corresponding to current security requirements. Why is this such a problem? In short, not every mechanism allows to verify to whom a user is authenticated. And because it is sometimes a technological challenge, the design of the mechanisms quietly assumes that this control will be provided by the users. The consequences of such a procedure may be, for example, forged login services, which in turn allow the misuse of accounts. Therefore, it is an effort to solve these problems, as access is offered by the so-called MFA (Multi Factor Authentication).
Why MFA is interesting
MFA is the use of principles, when the user knows a secret (password, key), but at the same time it is possible to ensure its authentication by means of something else that they own, who they are or even other secrets. For example, a device that provides them with data important for login, such as a mobile phone or e-mail account, to which the authentication message arrives. The weakness of these procedures is a maximum effort to simplify and ensure user comfort. This can only be done to a certain extent. Therefore, it is difficult for the user to determine whether there was accidental multiple login or forgery of the target server. Similarly, it is difficult to detect a potential attacker intercepting communication with the device, or possibly directly attacking the device and controlling it. Such efforts present a large number of technical challenges. Therefore, the aim is to use as one of the methods of protection the extension of MFA properties by the method of authentication through another channel (OOB - Out Of Band).
Why use OOB
This is the use of MFA, where each factor (each separate property) is authenticated by another channel. This limits the possibility of attacking the platform or channel, because without additional information provided by another channel, login is not possible. But as all systems gradually adapt to user comfort and safety comes second, the "comfort vector" becomes the biggest weakness. This risk is currently found in a large number of mobile applications that provide user identification and authentication in one place for convenience. As a rule, one channel is used because comfort has the highest priority at the expense of security. The control of such a device can then have fatal consequences on user privacy.
Biometric authentication
Apparently, everyone wonders why it is difficult to solve authentication when it is possible
to provide authentication by fingerprint, photograph, voice or other measurable characteristics
of the person. This comment is very difficult to answer. The reason for the difficulty of answering
this is actually just to measure the capabilities of biometric sensors. Each such sensor has a
certain reliability, called False Positive Rate (FPR, usually 0.01%) and False Negative Rate (FNR,
usually 0.1%). These values determine the error rate of a device where the false positive frequency
specifies how likely the accidental user will be falsely accepted in the system. By contrast, the
false negative frequency determines the probability of rejecting the correct user. Moreover, you
can never be sure if you are not in control of such a device.
For a closer explanation of the terms FPR and FNR. An example of a false positive confirmation is
when a doctor identifies a young man as pregnant on the basis of morning sickness. Conversely, a
false negative confirmation is in the case of declaring a woman in late pregnancy to be a simulant
because she is missing morning sickness.
Currently, thanks to developments in security, it is possible to create universal fingerprints,
false audio tracks or even universal faces. Artificial intelligence is a huge and difficult problem
for biometrics. Outside of artificial intelligence, there is the development of technology, where
cellphone cameras have managed to capture fingerprints on glasses, which could theoretically be
used to log in. Who knows where the boundaries are, biometrics are measurable signs specific to
each person. Because these are data, they are also falsifiable. Another curiosity comes from mathematics,
this is a simple work with percentages. If there are approximately 8 billion people in the world,
it would be necessary to use at least 4 different biometric factors to determine the corresponding
person reliably enough (0.01% from 0.01% from 0.01% from 0.01%). Therefore, at present, biometrics
can only be used on the basis of an appropriate risk analysis. For some situations it is sufficient,
at other times it is absolutely inappropriate. However, the mentioned risks must always take into
account the influence of the environment.
Station verification problems
Even if the above mentioned problems are covered, not everything is solved. Unfortunately, this analysis lacks a basic article. The user logs in from a particular machine. We verify the user and theoretically the server, but how do we verify the trustworthiness of the device? How do we determine compliance with the security policy? How do we work with an unknown device? If this problem is discussed, the device under your control can be controlled to a certain extent. Third party devices cannot. When and under what conditions can you allow logging in from such machines even with the risk of leaking login information? Or at the risk of letting an intruder into your internal network? These are matters that can no longer be solved technically and it is necessary to set the login rules appropriately. Generally, the problem mentioned is included under BYOD (Bring Your Own Device), but this is not entirely true. Sometimes it is "I used a foreign device" (IUFD), which is a completely different problem.
Problems solved by cryptography
Cryptography solves a lot of interesting problems during login. First, of course, it is necessary to ensure the protection of the transferred information and its integrity. It is necessary to ensure its authenticity and it would be nice to ensure its non-repudiation (it was really sent by this user and no one else). But there are other problems besides the above. First, the transferred login data must never be repeated and must be almost random and unpredictable. First of all, the password must not be repeated, so how do we process it to make it different every time? Is it necessary to transfer it at all, is it not possible to replace it by other ways? At the same time, it is necessary to ensure that once used login cannot be sent again, it is difficult to impossible to counterfeit it, it is not possible to "forward it", it is not possible to use the older version of the algorithm without the user's consent, obsolete or weak algorithms are not used … and all this must be accepted at the same time by the authentication of the target system, supporting technologies such as MFA, OOB and others. What can be done, none of the technologies is completely without error, and there are not many possibilities on the market.
Central Authorities
Different central authorities are an interesting approach. They have their advantages, because the authentication takes place against the authority and the aim is to ensure secure authentication mainly against it. Subsequently, the authenticated identity is provided to other systems, which can only carry out the authentication. There is only one big BUT. If such an authority is attacked, or if it is not working (signle point of failure), all the linked accounts can be abused. Trying to centralize is sensible, but not in all circumstances. Using central points is thus only relevant until they are attacked, i.e. it is a matter of trust. On the other hand, such a central point is of great importance for internal use in different organizations. Why it is difficult to delete an account from tens to hundreds of systems when it can be managed centrally. Leaving a worker thus means deleting all of their login data. It is not left anywhere like a funeral account forgotten for years, which is slowly becoming a time bomb.
Type of login
Although login is a basic method, it rarely supports so-called temporary locking (Intruder lock-out), which locks the account in case of a large number of bad logins. Except in rare cases, it does not support coercive and alarm login, when user permissions are limited, or informing the person responsible. These methods are virtually forgotten and their use is minimal. In addition to the above-mentioned methods of protection, password-less authentication is now taking the course. The name is a bit misleading, it is always necessary to use a password, whether it is a system password, to open a database, etc. But, more importantly, well-used methods not only ensure the protection of the transferred information, but also ensure its unpredictability. As a rule, a procedure known as "bilineration pairing" is now used for these purposes. Unfortunately, some password-less mechanisms use different or outdated methods that do not offer sufficient protection.
Conclusion
Login is a complicated system that we still do not have completely under-developed. Some of the methods are now obsolete, others can have serious problems. Administrators who confuse the notion of password policy and login management are also obsolete, but this can be done much better. Centralization of login in companies is practically necessary, but this is not always the case with centralization of login for personal use. It can lead to a loss of privacy and should be part of a person's decision whether or not to use it. Therefore, it is necessary to consider very carefully what we want to address and what we are protecting ourselves from.
Autor článku:
