crypto? is that some Southern kid's name?

i'm always amazed at this. on looking at the passwords for a small section of a network, i found that despite the strict password policy, all the passwords but three - out of several hundred - were words. the policy demands alphanumerics and mixed case, so most users had a "Password123"... oy.

i asked a couple other users what the hell was with that. the response?

"Well, normal people can't remember codes."

like fuck they can't. i'm a normal person, apart from being slightly better educated than the general public, and i remember about 10 different alphanumeric codes with random punctuation marks for all the different shit i have to authenticate to in a day (use mnemonics!). if you have to use each code once or twice a day, it really isn't difficult to memorize them; and these other students only have the one system password that's enforced to be so complex. the rest of their passwords, for all the things i keep seeing them wasting their time with - Bebo or Myspace, usually (you know what i think of Bebo and Myspace) - are set by themselves, of course, and they're uniformly simple.

so what's the problem? why can't you remember one code? i guess that's a question for a psychologist. my problem with this is that when they can't remember it, they write it down; and when they write codes down, the security of our collective system is down to someone not finding the paper.

obviously, that ain't acceptable. my solution with my own citadel was to implement a token system, which i'm in the process of linking to a chip in my hand (more on that when it's more developed) - and i'm unfortunately not allowed to RFID my compatriots. but i still think the token idea stands, and i'd kill to have a say on whether or not it's implemented here.

here's how the simplest token protocol works, from the seminal textbook, Ross Anderson's Security Engineering:

you have a token, a little transponder thing that can be shaped like a key, or a button, or even embedded in your ID card or something. i have a gate, or a door. you walk up to the door, and your token sends a string to the door's reciever:

token -> gate: serial number, {serial number, onetime number}

the stuff in braces is encrypted under a key known to both the transponder and the reciever, meaning my gate can then decrypt it, check that the two serial numbers match, check that the onetime (Anderson calls it a nonce, but in my country that's slang for a child molester...) hasn't been used already (this way i know you're not just replaying someone else's earlier access attempt) and lets you in.

now, replace the gate with the logon system, and you're flying. it's a little more difficult than that, unfortunately, so i won't be seeing it around here anytime soon. unfortunately, the fact remains:this kind of system is the only way to let normal people slack off remembering their codes.

so: either ya remember your damn password, or you let a totally non-medically qualified, slightly paranoid security nut embed machinery in your hand. okay?

...where are you going?


Lepht