RE: Two-Factor Authentication on the Web

["James Pujals" <james.pujals () sterlingpayment com>]

Hello:
   But even when biometric authentication "works", it still does not prove my _identity_, it just proves that I am who 
*I said* I am, which is another thing entirely; and some might say is its most obvious point of failure.  What's worse, 
as opposed to other 2-factor authentication methods (e.g. something I have, something I know), the "something I have" 
with biometrics, or as you say the "something I am" is not easily or practically replaceable if by chance it gets 
subverted.  And thus, given its inherent value and importance to its owner (I'm pretty sure we all want to keep all our 
fingers, eyes, etc.), the more value placed on the payload it guards (i.e. bank account, medical records, credit 
history, etc.), the higher the risk increases for its owner; as not only can someone clean up your savings account, but 
they will necessarily have to kill, maim, or otherwise molest of you in the process.
 
       -dZ.

________________________________

From: Tim [mailto:pand0ra.usa () gmail com]
Sent: Fri 06/30/2006 11:45
To: Andrew van der Stock
Cc: Webappsec Mail List
Subject: Re: Two-Factor Authentication on the Web



What I was trying to say is that you can only authenticate someone
through biometrics because it is something that they are. I do not
dispute that technology can be subverted or that people can be
manipulated. What I am trying to say is that a label (name, ssn)
cannot be trusted, especially nowadays. I feel the same in that
regristration would have to be done in person but again that is
impractical. Again, I am not saying that the current biometrics
technology is an adequate solution. Just that the concept of
biometrics is the only way to validate someone's identity.

You seem to be very familiar with biometrics, can you provide some
examples of products that you have experience with that you would
consider to be a scam and what ones (regardless of expense) are
adequate?



-------------------------------------------------------------------------
Sponsored by: Watchfire

As web applications become increasingly complex, tremendous amounts of
sensitive data - personal, medical and financial - are exchanged, and
stored. Consumers expect and demand security for this information. This
whitepaper examines a few vulnerability detection methods - specifically
comparing and contrasting manual penetration testing with automated
scanning tools. Download "Automated Scanning or Manual Penetration
Testing?" today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm
--------------------------------------------------------------------------