syssec_red_book

7.6. Research Gapshashes and evaluating passwords. We should emphasize that, compared tobrute-force attacks, these functions have much less effect on dictionary attacks.7.6 Research GapsText-based passwords are convenient and are already accepted by the majorityof users. However, today we need stronger authentication mechanisms.Rich Authentication. It is well known that for authenticating with a partywe use something we know (i.e., a password), something we have (i.e., atoken), or something we are (i.e., biometrics). There is an interestinggap between security and usability in current forms of authentication.We have strong authentication mechanisms, but it is hard to use themeffectively because they are not convenient. On the other hand, there arecertain mechanisms that are already accepted by users, such as text-basedpasswords or 4-digit PINs. Unfortunately, these provide low securityguarantees. One research challenge is to invent new rich authenticationmechanisms, variants or combinations of the currently existing ones, thatprovide better security without sacrificing convenience.Service Decoupling. Services experience heavy interconnection, explicitly orimplicitly. It is common practice to use an e-mail service for registering(or resetting the credentials) to another service. Social applicationscan also interfere with content delivered via third-party networks. Forexample, a Twitter account may post comments in the user’s Facebookfeed, if it is so configured. This service coupling provides new anddynamic functionality; however, it is security sensitive. An attacker needsonly to compromise one service and may then take over many of thevictim’s valuable assets just by exploiting this service interconnection [126,212]. It is challenging, from a research point of view, to identify all thisinterconnection, create taxonomies with current practices, study the wayscurrent services interconnect with each other, and design new techniquesfor interconnecting services in a secure fashion.7.7 Example ProblemsSome interesting problems in this area include:Factors in Authentication. It is common to combine multiple communicationchannels for providing stronger authentication, something commonlyknown as 2-factor authentication. As a quick example, consider a userauthenticating with a service by giving a password and a code receivedby SMS. It is debatable which factors are more efficient from the usabilityperspective, while providing the most security guarantees.57