Schneier on Security

Clive Robinson • January 21, 2020 1:38 PM

@ Sok Puppet,

Then some idiots started trying to use phones for Two Factor Authentication(TM), and some even bigger idiots started pushing that cheesy hack as a Universal Best Practice(TM).

I was one of the people who pushed for the use of mobile phones as a seperate side channel for authentication via SMS –unreliable at the time– or by auto-call[1], back last century.

Now you can shout and scream at me if you wish, but please remember you are judging me and others by a current world view not that of nearly a quater of a century ago.

Since then we have had atleast 14 generations of technology updating, one of which is Smart Devices. Most attacks on modern Smart devices won’t work against old dumb phones…

Thus you need to view the decisions made twenty years or so ago in not just the technology of the time, but also the realistic projections of where technology was going at the time. I can assure you that back then neither the Internet or the modern smart devices to connect to it were much above the noise floor in their crystal balls. You will find some place on this blog the fact that when I realised where things were going I tried to come up with a fix for SMS as a side channel for transaction authentication. I realised that the average human was not capable of doing the work required so looked for something that was easy for humans but difficult for computers. Those god-awful “capatchers” came to mind, but what I did not know at the time was that you could rent people at a couple of cents each to read them… so not a good idea 🙁

The simple fact is with the advances in smart phones security becomes harder and harder because of the increasing levels of integration…

[1] Auto call realy was a very bad idea, however at the time I was working for an organisation that worked with what was at the time a major player in the “voice-recognition” market. So against my better judgment it got put into presentations etc by those on a higher pay grade, and they put my name against it as the technical representative… Which made me hunt out a solution to the unreliability of SMS’s dur to the fact they were a secondary service which is to send a no-ring call to the phone (ie a primary service). The network will let you know if the phone is both on, in range and connected which means that the information needed to send an SMS gets updated in the phone companies location database with valid information before you send out the SMS. Since then the mobile phone operators have improved the reliability of their location databases so less SMS’s get delayed or dropped, but it still happens so you need to build in fault tolerance. The problem with certain types of fault tolerance in security is that under some circumstances it can be used as a partial or full attack vector[] thus you need to know how to do things in certain way.

[] To see why Fault tolerance can weaken security think about “password retry”. In effect it’s a fault tolerance mechanism against “line noise” but because it alows retrys with different passwords it weakens password security, it’s a “Catch-22”. Though not all fault tolerance systems weaken security, for instance some types of Forward Error Correction significantly help with line noise, but do not realy weaken security if you do it correctly. The trick is knowing what “do it correctly” realy means, and that is by no means common knowledge.

Clive Robinson • January 21, 2020 2:33 PM

@ Bruce,

[Service Provider] Companies could make the fraud harder, but it would necessarily also make it harder for legitimate customers to modify their accounts.

You’ve not mentioned other reasons why the service providers do not want to make it harder.

Firstly the cost of increasing the security especially to stop “insider attacks” would be immense, and gain the service providers no benifit what so ever. Their profit margins are not what they once were, so unless regulation is passed making all service providers put in the required measures it is not going to happen (hence it’s another fail for those claiming “the free market and deregulation” is a good thing etc).

But as you note it would make life “harder for legitimate customers”, this has a knock on effect of “customer dissatisfaction” which is unfair on the service providers. That is whilst this appears to be a major security issue, it actually effects very few of the service providers customers. And lets face it, it is the customers, fraudsters and financial organisations that are realy at fault not the service providers.

Even if regulators and legislators put a requirment on the service providers and they followed it scrupulously, the financial fraud aspects would just continue by moving to another attack vector.

Because it’s not the technology that is failing, it’s a failing of the financial organisations and the customers. And the financial organisations have absolutely no intention of stopping the way they have externalised the risk, they have profited greatly by shutting down bank branches and laying off very large numbers of staff. Worse the customers don’t want security what they want is two fold,

1, Convenience.
2, Some one to blaim for their failings.

And as long as those two hold prevalence with sufficient of the financial organisations customers the fraudsters will keep up the attacks irespective of the underlying method used to make the attacks.

Simplistically when the strength of the links in a security chain are decided by two or more unrelated parties each of the parties will seek to spend the least they can on the links they have responsability for and externalise as much of the risk as possible onto the other parties involved.

How you would even think to solve this problem would be a topic for a whole different thread.

Clive Robinson • January 22, 2020 7:06 AM

@ Fazal Majid,

As for Telcos, many have outsourced so many core operations they wouldn’t be able to get a grip even if they wanted to, as with this excellent article by my former colleague Bert Hubert:

I’ve been warning about the dangers of out-sourcing on this blog for so long now, it’s kind of like being a “One man bad, playing 60’s favourits on the street corner”.

I first saw the effects of out-sourcing on a UK industry with the demise of UK consumer goods manufacturing companies, back in the 60’s and through the 70’s. Followed by the demise of the UK companies who had been their supploers during the 70’s and 80’s. The easiest to see was the use of first cheap then very expensive CRT’s from Japan, which destroyed the UK Television manufacturing industry.

For my sins I was also involved with the “out-sourcing of technology” in both the petro-chem and telecommunications markets, where all but one of the companies I worked for are now gone by take-over or competition that could not be fought. Again from the Far East with significant backing from their governments. Now we have China “doing the same” whilst most western nations get little or no support from their governments, in fact in the UK and US active hostility via lobbying from both out-sourcing recommending accounting firms and other parts of the Finance Industry causes active hostility.

The real harm out-sourcing does, is supprisingly to many not the immediate movment of economic churn, which is very devistating in it’s own right, but is in the longer term as bad as civil conflict. That is the brightest and best effectively are forced to “up-sticks” and become refugees in another country, often one that has benifited from the economic churn, and they don’t come back except maybe to die. Sadly it’s not just their expertiese that goes with them never to return, but also the mentoring and training that support the often dry academic teaching, because all engineers unlike some scientists can not work on theory alone, engineers are if you like, similar to thoroughbreds / athletes they have to be bred, nurtured, raised, and excercised untill honed, teaching just helps the process of making an engineer. Teaching is not as politicians and others seem to think, the way to make engineers, or for that matter anyone covered by “STEM” as a domain of expertise, they need to have “oppertunity” and “reward” along with other socio-economic benifits, not for a few years but a lifetime so that they can see it is worth investing their life in.

As I think Bert Hubert’s article should be read by all the readers of this blog I’ve posted the link on the latest Friday Squid page,

https://www.schneier.com/blog/archives/2020/01/friday_squid_bl_712.html#c6804614