Authentication and Identity Systems Brad Hill Me iSEC Partners: - PowerPoint PPT Presentation

Nov 15, 2023 •226 likes •343 views

Common Flaws of Distributed Authentication and Identity Systems Brad Hill Me iSEC Partners: 2005 Mid-April 2011 PayPal ISG: Mid-May 2011 - ??? Reminder: This workshops RFP close: Early April 2011 My position paper does not

Common Flaws of Distributed Authentication and Identity Systems Brad Hill
Me • iSEC Partners: 2005 – Mid-April 2011 • PayPal ISG: Mid-May 2011 - ??? • Reminder: This workshop’s RFP close: Early April 2011 My position paper does not necessarily reflect the views of my current or former employer.
What I used to do: • Break things (application security consulting) • Looked at lots of authentication systems – For hire – For fun – As historical background to the above • Found lots of bugs and flaws – WS-*, Public Key Kerberos, many more under NDA
Lots of the same flaws • Or flaws that rhyme • Pentesters develop an intuition about such things • A bit different than an academic researcher might
My project: Make that intuition useful to others • Train other security testers • Educate developers and designers to reduce avoidable mistakes • Risk management targets for ecosystem participants
“Common Flaws and Failures of Distributed Authentication and Identity Systems” • An “OWASP Top 10” for enterprise and federated authN systems • Presented at RSA 2011 • Whitepaper at: https://www.isecpartners.com/ Research -> White Papers
The Top Flaws and Attacks 1. Unconstrained Delegation 2. Unbound Composition of Transport and Message Security 3. Un-Scoped or Over-Scoped Authority 4. PKI, PKIX and SSL/TLS Dependencies 5. Impedance Mismatch in Identity Contexts 6. False Dilemmas in Adoption vs. Assurance 7. Confused Deputy and DoS Attacks against Key Discovery and Revocation Checking 8. Crypto Implementation Foibles
ID in the Browser context: 1. Unconstrained Delegation = OAuth 2 token leaks 2. Unbound Composition of Transport and Message Security = TLS Renego, WWW-Auth forwarding attacks 3. Un-Scoped or Over-Scoped Authority = Compromised and/or incompetent CAs 4. PKI, PKIX and SSL/TLS Dependencies = All of the above 5. Impedance Mismatch in Identity Contexts = ID in the Browser is inherently cross-contextal 6. False Dilemmas in Adoption vs. Assurance = No signatures in OAuth2 7. Confused Deputy and DoS Attacks against Key Discovery and Revocation Checking = K.I.S.S. 8. Crypto Implementation Foibles = Not quite there yet today…
What I will be doing: • Now at PayPal’s Internet Standards and Governance group (with Jeff Hodges, Andy Steingruebl, et al.) • Work in the context of W3C and other orgs to develop, improve and promote new and existing security standards for the web
What I’m here to do: • Officially unaffliated • Here as an interested “expert” to help work towards the ambitions of my paper and contribute a perspective on WCPGW. (What Could Possibly Go Wrong?!?) • Unofficially acquire context and connections for my new role and goals
Thanks! Brad Hill hillbrad@gmail.com bhill@paypal.com skype + twitter: hillbrad

Recommend

External Identity and Authentication Providers For Apache HTTP Server Jan Pazdziora Principal

External Identity and Authentication Providers For Apache HTTP Server Jan Pazdziora Principal Software Engineer Identity Management Engineering, Red Hat 17 th November 2014 Basic Authentication The only authentication option in 1996 when

393 views • 21 slides

UCSB Identity and LDAP The central campus directory and authentication system UCSB Identity

UCSB Identity and LDAP The central campus directory and authentication system UCSB Identity System UCSBnetID authentication UCSB-wide student and employee info http://www.identity.ucsb.edu/ LDAP Overview Lightweight Directory Access Protocol

604 views • 24 slides

HOST Authentication Overview ECE 525 Authentication Overview Authentication refers to the

HOST Authentication Overview ECE 525 Authentication Overview Authentication refers to the process of verifying the identity of the communicating principals to one another Usually sub-divided into Entity authentication Authentication

288 views • 10 slides

Distributed Systems Authentication Protocols Paul Krzyzanowski pxk@cs.rutgers.edu Except as

Authentication Establish and verify identity allow access to resources Distributed Systems Authentication Protocols Paul Krzyzanowski pxk@cs.rutgers.edu Except as otherwise noted, the content of this presentation is licensed under the

228 views • 10 slides

Mobile Provided Identity Authentication on the Web tle pt by Jonas Hgberg, Ericsson for W3C

Mobile Provided Identity Authentication on the Web tle pt by Jonas Hgberg, Ericsson for W3C s WS on Identity in the Browser tle pt 24-5th May 11 Mountain View, CA, USA Mobile Provided Identity Authentication itle on the Web pt

298 views • 13 slides

Federated Identity, SSO and Multifactor Authentication June 23 rd , 2017 Computing Services and

Computing Services and Systems Development Federated Identity, SSO and Multifactor Authentication June 23 rd , 2017 Computing Services and Systems Development F EDERATED I DENTITY , SSO AND MFA @ THE U NIVERSITY OF P ITTSBURGH Tony Carra

542 views • 12 slides

A2: Broken Authentication and Session Management But first Authentication, Authorization,

A2: Broken Authentication and Session Management But first Authentication, Authorization, Sessions Authentication Determining user identity Multiple ways What you know (password) What you have (phone, RSA SecureID, Yubikey)

1.57k views • 28 slides

User Authentication for Emerging Interfaces Nasir Memon Tandon School of Engineering New York

User Authentication for Emerging Interfaces Nasir Memon Tandon School of Engineering New York University Identity Identity and Authentication What is identity? A computers representation of an unique entity (principal). What is

675 views • 56 slides

Outline Authentication and Identity Management Authentication Computer Security: Security at

Authentication and Identity Management Authentication and Identity Management Operating System and Network Security Operating System and Network Security Cyber war and terrorism Radboud University Nijmegen Cyber war and terrorism Radboud

590 views • 9 slides

Authentication, vulnerabilities, exploits, and the secure design principles of Saltzer and

Authentication, vulnerabilities, exploits, and the secure design principles of Saltzer and Schroeder Authentication in general Bishop: Authentication is the binding of an identity to a principal. Network-based authentication mechanisms

1.6k views • 43 slides

Recognize people by the way they type Typing Biometrics Authentication Cybercrime & identity

Typing Biometrics Authentication Recognize people by the way they type Typing Biometrics Authentication Cybercrime & identity theft 17 million victims $30 billion / year Typing Biometrics Authentication The way you type is unique Typing

143 views • 10 slides

Outline Computer Security: Security at Work Authentication and Identity Management Bart Jacobs

Radboud University Nijmegen Radboud University Nijmegen Authentication and Identity Management Authentication and Identity Management Outline Computer Security: Security at Work Authentication and Identity Management Bart Jacobs

405 views • 5 slides

B Three Factors Jointed to secure the user and their transactions A C Renaissance Systems,

Renaissance Systems, Inc. Adopts and Promotes Teleworking three-factor authentication (3FA) 3FA As part of our identity management process services we see , the first steps of access control is the identify and authenticate the users.

434 views • 4 slides

1 Message Encryption- see Table 11.1 in the book Message Encryption if public-key encryption

Message Authentication CPE 542: CRYPTOGRAPHY & NETWORK SECURITY message authentication is concerned with: protecting the integrity of a message Chapter 11 Message Authentication and validating identity of originator Hash

462 views • 6 slides

3-509

3-509 liuzhen@sjtu.edu.cn 1 Authentication and Key Exchange 2 Authentication Alice proves her identity to Bob Alice and Bob can be humans or

524 views • 23 slides

Put Identity at the Heart of Security Strong Authentication via Hitachi Biometric Technology

Put Identity at the Heart of Security Strong Authentication via Hitachi Biometric Technology Tadeusz Woszczyski Country Manager Poland, Hitachi Europe Ltd. 20 September 2017 Financial security in the old world The Perimeter Assets were

659 views • 31 slides

Outline Authentication and Identity Management Computer Security: Security at Work

Authentication and Identity Management Authentication and Identity Management Operating System and Network Security Operating System and Network Security Radboud University Nijmegen Radboud University Nijmegen Conclusions Conclusions Outline

559 views • 8 slides

IDENTITY AND AUTHENTICATION Chad Spensky Allthenticate WHO AM I? WHO AM I? Chad Spensky

IDENTITY AND AUTHENTICATION Chad Spensky Allthenticate WHO AM I? WHO AM I? Chad Spensky (Professional) Ph.D. Student Computer Security Researcher Founder of Allthenticate WHO AM I? Chad Spensky (Social) Beach Volleyball

527 views • 42 slides

Django User Authentication OVERVIEW OF USER AUTHENTICATION Anthony Alampi OWNER, X FACTOR

Django User Authentication OVERVIEW OF USER AUTHENTICATION Anthony Alampi OWNER, X FACTOR CONSULTANTS www.XFactorConsultants.com User Authentication (Auth) The methods by which a web app verifies the identity of a user and limits their

334 views • 8 slides

1 Password-Based Authentication Node A has a secret ( password ): e.g., lisa To

Authentication Protocols Guevara Noubir College of Computer and Information Science Northeastern University noubir@ccs.neu.edu Outline Overview of Authentication Systems [Chapter 9] Authentication of People [Chapter 10]

396 views • 17 slides

Identity Metasystem in Location Based Persistent Authentication EuroCAT 2009 European Workshop

Identity Metasystem in Location Based Persistent Authentication EuroCAT 2009 European Workshop on Combining Context with Trust, Security and Privacy 9 September 2009, Pisa, Italy Hasan Ibne Akram M.Sc. Computer Science Fraunhofer Institute

510 views • 15 slides

ENGR 5770G : Service Computing / Winter 2013 Anwar Abdalbari Outline Introduction.

ENGR 5770G : Service Computing / Winter 2013 Anwar Abdalbari Outline Introduction. Identity Systems. Analysis of Identity Systems. Open Trust Frameworks. Shibboleth Approach What are we talking about? Authentication

829 views • 39 slides

identity services Sham Careem, Market Development Director, Identity, GSMA Can we monetise

Beyond authentication: monetising identity services Sham Careem, Market Development Director, Identity, GSMA Can we monetise customer data in a user friendly, non intrusive way which adds real value and utility to our customers ? Much of the

222 views • 20 slides

(Hierarchical) Identity-Based Encryption from Affine Message Authentication Crypto 2014 , Olivier

(Hierarchical) Identity-Based Encryption from Affine Message Authentication Crypto 2014 , Olivier Blazy Eike Kiltz Jiaxin Pan Horst Grtz Institute for IT Security Ruhr-University Bochum 1 Introduction 2 Affine MAC 3 From Affine MAC to IBE 4

880 views • 58 slides