Two Factor Authentication

re: Two Factor Authentication

Matt — Tue, 14 Aug 2007 05:53:21 GMT

Agree with xperts64 about MTTM. Not relevant and not realistic to most (if any) corporate remote sites.

Another great Strong 2 Factor solution is CAT (Cellular Authentication Token)™. The Token is a java application installed on the users cell phone. The user enters a pin number and access the OTP on the cell phone. Multiple Tokens can be installed on the one cellular device. Very simple to use and real convenient. A device the user always virtually always carries with them.

Once a hard token user has experienced CAT they would only reluctantly go back to the old hard token.

re: Two Factor Authentication

Charlie Russel — Sat, 04 Aug 2007 23:56:00 GMT

While a theoretical Man in the Middle (MITM) attack is possible, it requires a phishing site that a user would be willing to use and that used the same OTP mechanism. Not relevant or realistic to most (if any) corporate remote sites. Definitely something to think about with a commercial site, where it would need to be combined with additional layers of protection.

re: Two Factor Authentication

mitmwatcher — Sun, 29 Jul 2007 16:18:34 GMT

I was wondering You might of heard of a Active MITM attack which will lame all these OTPs..It is no great Rocket Science to automate this attack as kits are found in underground

Charlie Russel on AuthAnvil

Scorpion Software Corporate Weblog — Sat, 28 Jul 2007 03:50:03 GMT

If you follow the world of 64bit computing, you know Charlie Russel. He is a popular author of many computer books (I think there are like 40 you can buy up on Amazon) and is well regarded in his circle of influence. I find myself a fan of much of his

The Gummi Bear defense

E-Bitz - SBS MVP the Official Blog of the SBS "Diva" — Fri, 27 Jul 2007 19:25:10 GMT

I still remember the stories by Steve Riley about the deployment issues with Biometrics. Everyone sees