Forgot your password?
Close
typodupeerror
Earth

Geocentrists Convene To Discuss How Galileo Was Wrong 1027

Posted by timothy from the when-did-britain-pull-ahead dept.
rollcall writes "'Galileo Was Wrong' is an inaugural conference to discuss the 'detailed and comprehensive treatment of the scientific evidence supporting Geocentrism, the academic belief that the Earth is immobile in the center of the universe.' The geocentrists argue that 'Scientific evidence available to us within the last 100 years that was not available during Galileo's confrontation shows that the [Catholic] Church's position on the immobility of the Earth is not only scientifically supportable, but it is the most stable model of the universe and the one which best answers all the evidence we see in the cosmos.' I, like many of you, am scratching my head wondering how people still think this way. Unfortunately, there is still a significant minority of Western people who believe that the Earth is the center of the universe: 18% of Americans, 16% of Germans, and 19% of Britons." I hope there is live blogging from the conference.

Comment 2FA is only part of the problem (Score 1) 313

by qwepoi198273 (#13848885) Attached to: Banks to Use 2-factor Authentication by End of 2006
Two Factor Authentication is not the only part of the problem

Two Factor Authenticationis not the only part of the problem. It does helps a lot for strong authentication of the client. Some other important parts of the problem are:

  1. Mutual Authentication. Short term, need to have the FI display something unique which helps the user tell for sure they are connected to who they think they are connected to. Longer term, need changes to Firefox and IE6 (which for me means 95% of my customers) so that the PKI credentials for the FI are displayed.
  2. Need to be able to ask the client if I can query their computers status, and make sure that they have a current patch level and decent AV and Spyware protection. So, need to ask Linux and Windows (or other products installed on Windows and Linux) to provide capabilities, because I do not want to download code. After all, not my business. Could request this function with a special HTTP header.
  3. Mid term to long term, I love the idea of a second factor (USB attachment) which supports PKCS#11 / PKCS#15. This, along with #1, prevents MITM attack.
  4. Everywhere in the world, except maybe theU.S., we are rapidly rolling out EMV and VIS. So, we are going to have Smartcards in everyone's wallet, that will be a key part of the 2FA problem. Just need a small portable USB device to support a USB interface to the card. So far, I am having trouble with this, need something small enough to hang on your keychain. Wait a year or so, someone will build it.

On the server side, need to make some changes as well.

  1. Proper support for tiered authentication. So, you can access less dangerous functionality with less authentication
  2. Base the entire thing on a decent RBAC approach, so I can administer and keep track of what is going on. Note, DSD gives me a decent way to model tiered authentication.
  3. Need to build a proper authorization framework so that the requirements for both a proper authentication tier and even a signature (OTP, Digitial Signature) on specific transactions can be enforced.

The bottom line:

  1. The stronger the authentication of the client, the better. As we move towards 2FA, lets be careful to not make any stupid biometric decisions. Biometrics should only be used to gain access to the hardware second factor, for instance via a thumbprint. Then, it the second factor gets stolen, we just revoke the token; we do not need to cut off your thumb!
  2. Mutual authentication. Not only does the client need to prove who they are, the FI needs to prove who it is. Some cool stop-gate things with GIFs and stuff are possible, but in the middle and longer term, changes to the browsers (the two that dominate my customer base are Firefox and IE)
  3. Assurance the PC is protected. If you will excuse me the vanity, I will riff on "Clarke&'s Third Law", name it "Cameron's Law&", and state that "Any sufficiently infested PC cannot be protected from allowing the customer to be scammed". Frankly, I was really hoping that the Fed would step up to that in its Guidance!
  4. The MITM threat is real. But, it is not the most important threat - yet. The social engineering (phishing) and Spyware / Keylogger attacks remain the main threats.

Sandy Cameron

I've wasted a lot of money in my life, the rest I spent on motorcycles and women

Slashdot Top Deals

The tree of research must from time to time be refreshed with the blood of bean counters. -- Alan Kay

Close