Skip to main content

The WiKID Blog

The WiKID Blog, musings on two-factor authentication, information security and some other stuff.

11 Top tips for two-factor authentication

For a long time I have been meaning to pull together some of the top tips when setting up two-factor authentication. I expect this will be a moving target. Obviously, two-factor authentication is central to your network deployment, so even if that PCI QSA is breathing down your throat, take some time to do a bit of planning!

PCI compliance in the local news

The Atlanta-area transit authority was forced to accept only cash due to software errors it blamed on their efforts to meet PCI compliance.

WiKID support for Cloudstack

We're pleased to announce the release of a prototype authentication plugin for Cloudstack that will add WiKID Two-factor authentication to the administrator login. The jar is available for download at our Sourceforge site. The license is GPL. We have very brief installation instructions as well.

Thoughts on the RSA SecurID 800 paper

The original paper on the attack is Efficient Padding Oracle Attacks on Cryptographic Hardware' by Bardou, Focardi, Kawamoto, Simionato, Steel and Tsay> here (pdf). They have combined and optimized a handful of attacks against the PKCS#11 encryption that they claim make it possible to extract the private keys. There is a great summary by Matthew Green from John Hopkins.

I know something that isn't two-factor authentication

William Edwards wrote a post entitled "I know someone whose 2-factor phone authentication was hacked…" about a friend whose bank account was drained by fraudsters. His bank relied on a dial-back system. The attackers social-engineered BT to re-route the phone calls. This attack is eerily similar to the recent attack on Cloudflare, which started with an attack on an AT&T account.

Recent Posts

Archive

2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom