Problem - Kevin Tafuro

Solution
The correct method depends on your needs. When a server needs to be authenticated,
and the client does not, SSL/TLS is a popular solution. When mutual authentication
is desirable, there are a whole bevy of options, such as tunneling a traditional
protocol over SSL/TLS or using a dedicated protocol. The best dedicated protocols
not only perform mutual authentication but also exchange keys that can then be
used for encryption.
Discussion
An authentication factor is some thing that contributes to establishing an identity.
For example, a password is an authentication factor, as is a driver’s license. There are
three major categories of authentication factors:
Things you know
This category generally refers to passwords, PIN numbers, or passphrases. However,
there are systems that are at least partially based on the answers to personal
questions (though such systems are low on the usability scale; they are
primarily used to reset forgotten passwords without intervention from customer
service people, in order to thwart social engineering attacks).
Things you have
ATM cards are common physical tokens that are often implicitly used for
authentication. That is, when you go to an ATM, having the card is one factor in
having the ATM accept who you are. Your PIN by itself is not going to allow
someone to get money out in your name.
Things you are
This category generally refers to biometrics such as fingerprints or voice analysis.
It includes things you have that you are not going to lose. Of course, an
attacker could mimic your information in an attempt to impersonate you.
No common authentication factors are foolproof. Passwords tend to be easy to
guess. While cryptography can help keep properly used physical tokens from being
forged, they can still be lost or stolen. And biometric devices today have a significant
false positive rate. In addition, it can be simple to fool biometric devices; see http://
www.puttyworld.com/thinputdeffi.html.
In each of these major categories, there are many different technologies. In addition,
it is easy to have a multifactor system in which multiple technologies are required to
log in (supporting the common security principle of defense in depth). Similarly, you
can have “either-or” authentication to improve usability, but that tends to decrease
security by opening up new attack vectors.
Choosing an Authentication Method | 363
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.