For such prices, the seller offers some guaranties. For example, the purchase is covered by replacement, if you are unable - within the 24 hours - to log into the account using the provided details.

Hat tip Johannes Ernst

So when we think about passing up flight insurance, we conjure up disaster just as easily as ancient Greeks imagined a thunderbolt from Olympus, and we too figure we can avert it through the equivalent of a bull sacrifice. Intuitively, we haven?t made great strides since Homer?s day. But at least our gods take credit cards.

Hat Tip Marginal Revolution]]> http://www.wikidsystems.com/WiKIDBlog/security-through-lingual-obscurity On a recent trip to Mexico, our casita had a safe in it. The instructions for using it and the combination were printed on a c... admin Mon, 05 May 2008 08:34:28 -0400 On a recent trip to Mexico, our casita had a safe in it. The instructions for using it and the combination were printed on a covered sheet of paper sitting on top of the safe. As I scanned for directions on how to change the combination, I read:

Don't worry. Anyone here to steal cannot read this paper.

The net of all of this was to drive home, yet again, just how silly it is to use a ?public? secret as a proof of identity. The fact that I can somehow ?apply? a given fingerprint means nothing. Identification is only possible by physically verifying that my finger embodies some fingerprint. Without physical verifcation, what kind of a lock does the fingerprint reader provide? A lock which conveniently offers every thief the key.

Remember, all I knew about this guy was his cellphone number, that he was in his 20's, and that he lived in DC. That's it. That's all it took to completely hijack his entire Sprint account.

In the comments on this post, a former Sprint rep says it's even worse than we thought. They say that every question about cars has three luxury models and one typical one. He says that "none of the above" for "which properties have you owned" was correct 99% of the time. And worst of all, you only need to answer two of the questions correctly to gain access to an account. I was shocked at the number of times I was able to access an account by simply guessing the answers," he writes. "Fortunately I am an ethical person, but if I wasn't I could've done a LOT of damage very easily."

Companies make security decisions based on acceptable rates of false positives versus false negatives. The bigger the user base, the lower the tolerance for false negatvies. A cell phone company with 10 million subscribers will have a very low tolerance for false negatives. Do you want the same tolerance for your two-factor authentication? It seems highly unlikely.

More on SMS authentication issues

Update: I should also mention that it would be trivial to add support for Google Apps SSO into the WiKID server, removing the requirement for a 3rd party product. If there's interest in that...

Downtime expects Ken to have already ordered a two-factor authentication scheme to protect those afflicted with short-term memory difficulties, banned 3M?s best-selling product and instructed HR to re-do the background checks to weed out anyone with a malicious sense of humour.

With gas and oil prices so high, I get very flustered with: 1. The government attempting to make decisions the market should make, a la ethanol subsidies (makes you think ethanol is not the correct answer); 2. Calls for lower gas prices or the temporary elimination of gas taxes (Do you want to stimulate demand or stimulate the market for replacements?); 3. Calls to increase US production.

Oil is a finite resource, so it is very simple: whoever has the most last wins. If you have some extra that never gets used, that's probably OK, you have more than made up for based on the prices at the end. Unless we intend to switch all of our armed forces to something other than oil and gasoline, we should consider places like ANWR our strategic reserves.

Reading Yergen, in particular the WWII chapters, this need hits home. by the end of the war, Japan was trying to make fuel from pine roots. Interestingly, the post- war US administrations seemed most interested in developing non-US sources of petroleum, recognizing the need to save the US's reserves.

Party go-er: You do what? What is two-factor authentication?

Me: Well, you use it all the time at the ATM where you need both possession of the card and knowledge of the PIN to get your cash. Ours is like that, only you need possession of the secret key in our software and knowledge of the PIN to get a one-time passcode that you then use to get access to a corporate VPN or a website.

Party Go-er: Oh, my bank is using two-factor authentication. The second factor is a picture of a cat they have to show me.

Me:Yeahhh, that's not really two-factor. They are trying to prevent a man-in-the-middle attack by trying to identify the site to you in way that is simple. Unfortunately, there is still nothing that prevents and man-in-the-middle from replaying that picture to you because there is no cryptograpy involved. We have a process that combines one-time passcodes and a cryptographically secure mutual https authentication mechanism to prevent network-based man-in-the-middle attacks...

Pary Goner Oh, are they bringing our more pigs-in-a-blanket. I have to get more of those...

We've touched base with the Enterprise users that we know have used WiKID in their PHP applications. So far, no one has used that code. Rather, they have taken their existing authentication pages and added the WiKID code to bring two-factor authentication into the mix.

More information on the code in question can be found here

Updated: Corrected link.