Review of Security Now Podcast

Security Now Episode #107
PIP & More Perfect Passwords

I chose to read the transcripts rather than listening to the podcast because the banter was distracting so the link above reflects that. I tried listening to several and found that I was really confused by what they were discussing. I don’t think I know enough yet to appreciate what they have to offer but by going to the transcripts I was able to pick out a couple of items that I could learn more about online. Because of this I provided page numbers rather than times.

I wanted to have a better understanding about OpenID (Gibson 5). It makes sense that it would be good to have one (or more) ID that is held in a secure site that I could use to gain access to multiple sites without giving out my personal information to each of them. It seems like a common sense idea but not every site has an OpenID option, at least not yet. From what I could tell, more and more companies are adding this option because of the growing need for users to secure their personal information. This information would not be stored on the user’s computer either so if the computer were compromised this information wouldn’t be. Users gets to choose the OpenID Provider that best meets their needs and most importantly that they trust. At the same time, their OpenID can stay with them, no matter which Provider they move to. And best of all, the OpenID technology is not proprietary and is completely free. (OpenID.net)

I also learned about dongles and fobs(Gibson 8). Dongles are hardware devices that are attached to the computer for verification of software, also sometimes referred to as hardware keys. “Dongles evolved and have become secure cryptoprocessors that execute inaccessible program instructions that may be input to the cryptoprocessor only in encrypted form.” (Wikipedia) Still, they are not a perfect protection. Fobs are external security tokens often found on a key chain much like jump drives. They can be used to store passwords or to generate a one-time password that changes after each login, or changes after a set time interval. This fob may provide a “time-synchronized one-time password change constantly at a set time interval, e.g. once per minute. For disconnected tokens this time-synchronization is done before the token is distributed to the client, other token types do the synchronization when the token is inserted into an input device.” (Wikipedia)

Steve Gibson and Leo Laporte also discuss password generators that use a “monotonic counter, meaning a counter that only goes up, never goes down.” Mr. Gibson developed a system that “generates the thing [he calls] a "cryptoken," which is a nonrepeating token that is used in order to hand our individual ecommerce users a token that’s only good once (Gibson 11). This is something that I am still trying to understand but from his description it basically helps provide passwords that are virtually impossible to break. I don’t understand all the number crunching involved but the idea is that they are providing users with more security and confidence when online, which is something everyone needs more of.