The WiKID Blog

Viewing posts by root

Can I use WiKID for two-factor authentication for GDM/XDM/Gnome/KDE login?

Posted by: root 15 years, 3 months ago

Most Linux services use PAM, so 'Yes'. Just configure /etc/pam.d/login to use Radius and you should be good to go.

Why did you release an open source version?

Posted by: root 15 years, 3 months ago

We want people to use our software.

We benefit from feedback from users whether they pay or not.

We want to partner, not just with proprietary software developers, but also open source projects and other 'dual source' companies.

We hope that evaluators will actually look at the code for weaknesses and help us make the product better. It ain't fixed until you've broken it.

We use open source software everyday and wanted to give something back.

How are users provisioned? How is initial validation handled?

Posted by: root 15 years, 3 months ago

A big problem with hardware-based tokens and traditional soft-tokens is the need to get the token or data file to the end user securely and to associate it with the user on the server. Typically, there is a big box of tokens in a secure location, the security administrator grabs a token, enters the serial number into the user’s account on the server, and overnights the token to the user. The next day, he overnights a new PIN number for use with that token. Obviously, this process is an expensive waste of time for a highly paid security professional. WiKID Systems’ elegant architecture allows for a fully automated initial validation when our system is combined with a trusted network or existing trusted relationship.

First, the end-user installs the client on the device (over-the-air download or via the Internet installer) and logs into a web site, over a trusted LAN or using an existing hardware token or some other trusted mechanism. The web site provides the user with a 12-digit code that represents the IP address of the authentication server. The user selects ‘New Domain” to create a new trust relationship and enters the 12-digit number.

The WiKID client generates its own public/private key pair and sends a request to the server along with it’s public key. The server responds with a configuration file and its public key, encrypted with the client’s public key. Already, we have asymmetric encryption! The user enters his chosen PIN, which is stored on the server and the server responds with a registration code. The user enters the registration code into the web site and he is finished. If the administrator allows automated initial validation, the user can start generating valid passcodes and can throw away their token (or, more likely, they can return it for recycling to a non-WiKID user). An administrator can easily add a user manually as well.

Aren’t wireless networks and devices inherently insecure?

Posted by: root 15 years, 3 months ago

Yes. That is why we asymmetrically encrypt all the transmissions. Each communication between the device and server is atomic as well, increasing security.

How can a software token be as secure as a hardware token?

Posted by: root 15 years, 3 months ago

Simple, really.

There are two factors: possession of the private key and knowledge of the PIN. The private key is stored on the client. Our PC client, for example, this key is in a password-protected PKS12 encrypted file. If someone steals this file and brute-force attacks it and gets the passcode, they are only half-way there.

They still need the PIN. The PIN is stored encrypted on the WiKID server. Losing the private key is the equivalent of losing a hardware token. You're only half-way there.

Typical software tokens store the PIN, the secret and the algorythm all in the client. Clearly this is not the way to do it.

• Page 12 of 14
• ←
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• →