Schneier on Security

Davi Ottenheimer • March 11, 2005 5:02 PM

Kudos to MS for trying to integrate into AD. I wonder if users would also be able to type a response on the keypad instead of, or in addition to, using voice? Maybe it would have to be licensed separately, as the Microsoft 2004 Keypad Server.

Davi Ottenheimer • March 11, 2005 6:02 PM

@Saar
There are many companies already using voice password reset. It’s a lot easier to do than complex dictation since the dictionary is determined by the user (when they choose their own secret prompts) and therefore not anywhere near as difficult as random speech.

I’ve seen claims of wild success using speech reset:
http://www.speechtechmag.com/issues/8_6/cover/2757-1.html
In early 2003 “more than 40,000 employees have successfully enrolled in the system, and the application is now resetting over 20,000 passwords per month across more than five different back-end systems, taking a significant load off the help desk.”

Davi Ottenheimer • March 11, 2005 9:39 PM

@James
The article states that users are asked to choose a set of secret prompts. They then answer questions they are asked via phone. Since it’s a two-factor system (something you know, something you are) an attacker would need to know the questions to produce the right answers in a voice comparable to the victim’s. The complexity of the problem is in proportion to the randomness of the questions. Or if users really lose their password often enough, they might cycle through all their prompts quickly and an attacker could just intercept and record all the possible answers.

I think the beauty of this system is not the actual mechanism, but that it uses existing and pervasive technology (phones) to implement a stronger and more efficient system of self-authentication. Retina, fingerprint, or palm by comparison, would require a complicated system of dedicated readers.

I do not think anyone is saying voice/phones are especially tough to defeat, as seen with the latest VoIP attack tools that simply dump conversations to WAV files for replay.

Davi Ottenheimer • March 11, 2005 11:45 PM

@Bruce
I don’t think it works quite that way, although you might be onto something even more interesting.

Here is the example scenario provided in Microsoft’s press release:

“Now consider this comparatively painless scenario using an automated password-reset application: An enterprise worker on a business trip wants to check her e-mail from her hotel room, but she cannot access her account because she has forgotten the new password she received the day before. The worker uses her cell phone to call the voice-activated reset application. The call is answered immediately, and the application reads the cell phone number — the first of several steps to authenticate the caller’s identity.

Next, the application retrieves personal information about the worker — entered into a Web page upon enrollment — from a data store such as Microsoft Active Directory. It randomly selects two of four “smart” personal questions and prompts the worker to answer them for verification. If the worker is authenticated, the application then creates a new temporary password, performs the reset, reads back the password over the phone and gives the worker 10 minutes to use it. The worker hangs up, logs on and is immediately asked to change the password.”

Davi Ottenheimer • March 13, 2005 12:30 AM

@Michael
It is common practice for companies to know the cellphone numbers of their employees. The whole idea of this system is another way to leverage a robust directory with all sorts of data to validate an identity. In fact, the system could prompt users only for their directory information, but that is obviously less secure than a secret. So instead the system validates a caller’s cellphone number, name, etc (that defines their identity) and then uses an automated system (less chance of accidental disclosure/theft) to prompt the caller with a voice-based secret.

This is quite a bit better than calling the helpdesk and having someone on the phone create a new password and then tell you or email it…it’s also quite a bit easier/cheaper than trying to implement any other form of biometric identification.

All that being said, and as much as I like the idea in a general sense, this reminds me of the old business pitch that if you install ATMs you will reduce teller costs, or if you install voice-recognition systems in hospitals you will no longer need to pay transcriptionists…somehow the technology never really does as well as the prior human-only process and we all end up paying more to maintain limited aspects of both. Early adopters beware.

Davi Ottenheimer • March 13, 2005 4:05 AM

@Michael
The cell phone was just an example. The system could require users to call from their cell phone, or not. It shows that you could provide extra control mechanisms for a password-reset.

In the example from the article, we are to believe that the person needs a password reset for their email. Therefore, they can not be reasonably expected to get a new password via email. And if they call the helpdesk for a password reset, they create load on the helpdesk personnel and introduce the risk of someone on the helpdesk knowing their password, even if only for a brief period.

If you prefer a web-based password reset screen, more power to you. But many people do not and phone-based is a different mechanism that seems to be baked into Microsoft’s directory — options are good. A phone-based system will not be “strong” authentication by itself, but it could easily be stronger than web-only (since it requires both something you know AND something you are). And again, the real beauty of the system is that if you set strict password policies users only need access to a phone, which should make them more likely to comply and less likely to demand that they need an indefinite timeout on their passwords to function…