an idea for easy two-factor authentication (Attn: Mt.Gox)

vectorvictor

newbie

Activity: 28

Merit: 0

Quote from: ikonic on July 07, 2011, 07:01:36 PM

Quote from: vectorvictor on July 04, 2011, 01:49:31 PM

(1) To set up my 2-factor login, I send you a string of 260 symbols, to be interpreted as a passcard with 10 rows (0-9) and 26 columns (A-Z).

The problem with this method is that if you are sending this information over the internet then it has failed since most trojans record all HTTP traffic

Theory versus practice. In theory, you're bugged all the time, forever. In practice, there is a notion of before and after. Yes, if you caught my code when I sent it, then I'm no safer (and no worse off). But if you came along *later* and started snooping around my computer, then I am safer.

More to the point, if you are in Bulgaria taking shots at my password (or if you got your hands on the password database and eventually cracked my hash), then you still can't log into my account. (Unless you also crack my 260-symbol random passcard -- good luck with that).

I'm not sure why practical measures like this are given little or no weight by the security community. They always seem to be seeking the perfect system, rather than looking for simple practical improvements. However, I freely admit that I don't know all the issues, so maybe they have very good reasons for taking that approach (like, having been burnt so many times in the past).

legion050

newbie

Activity: 51

Merit: 0

Quote from: vectorvictor on July 06, 2011, 12:18:21 AM

Another passcard service I found, with an open source algorithm and mobile support is:

https://www.passwordcard.org/en

I have used that before, works well.

error

hero member

Activity: 588

Merit: 500

Quote from: ikonic on July 07, 2011, 07:01:36 PM

Quote from: vectorvictor on July 04, 2011, 01:49:31 PM

(1) To set up my 2-factor login, I send you a string of 260 symbols, to be interpreted as a passcard with 10 rows (0-9) and 26 columns (A-Z).

The problem with this method is that if you are sending this information over the internet then it has failed since most trojans record all HTTP traffic

Over https?

ikonic

newbie

Activity: 15

Merit: 0

Quote from: vectorvictor on July 04, 2011, 01:49:31 PM

(1) To set up my 2-factor login, I send you a string of 260 symbols, to be interpreted as a passcard with 10 rows (0-9) and 26 columns (A-Z).

The problem with this method is that if you are sending this information over the internet then it has failed since most trojans record all HTTP traffic

anthony.selby

newbie

Activity: 42

Merit: 0

I Love the smart phone app id ....

I think the odds of guessing the next random number from a smart phone is going to be rough ...

why can't I have a app that app on my smart phone app that sends a random number to mt gox or tradehill (only good for 3 mins) that I have to enter in to the site to login

Not sure how that would solve a database hack (like at gox) but would require someone to break the password and have the verified cell phone (over sms, an android app could watch for it in setting up the phone the first time)

It would allow me to not have to buy some key, and what happens when I lose/break the key ?

vectorvictor

newbie

Activity: 28

Merit: 0

On topic, csshih posted this to the Trading section:

http://forum.bitcoin.org/index.php?topic=26385.0

Mt.Gox is introducing Yubikeys (a USB device for 2FA), currently in beta to ~50 users. They will be making them available for purchase for $30 (BTC accepted, naturally).

The bashers can't bash that!

vectorvictor

newbie

Activity: 28

Merit: 0

Quote from: JohnBigheart on July 05, 2011, 04:06:08 AM

I am posting this on behalf of dsp(http://forum.bitcoin.org/index.php?action=profile;u=31526) a newbie who is restricted to the Newbie forum:

Quote

Cant post to this thread: http://forum.bitcoin.org/index.php?topic=25982.0
Want to post a link to one of myprojects:
http://www.otp2fa.com
I Sent this to mtgox told em they could use it for free/cost.

Original post is here: http://forum.bitcoin.org/index.php?topic=26124.0

Oops, dsp sent me his link, but I didn't understand that he couldn't post it, due to his n00bie status.

Also, jaakkop (http://forum.bitcoin.org/index.php?topic=26124.msg326768#msg326768) mentions this tool from Google:

http://code.google.com/p/google-authenticator/

Another passcard service I found, with an open source algorithm and mobile support is:

https://www.passwordcard.org/en

cypherdoc

legendary

Activity: 1764

Merit: 1002

i like my Yubikey

netrin

sr. member

Activity: 322

Merit: 251

FirstBits: 168Bc

Quote from: indicasteve on July 05, 2011, 02:31:03 PM

I'm making an app on google's appengine and was considering using OpenID for user authentication....researched it quite a bit, but openid on appengine dont work with https... so that kicks that idea to the curb for now.

Google's own implementation of openid works on appengine https, but you require a google account....

Let us not call Google or Facebook authentication OpenID. They both are OpenID providers, but not consumers. No one wants twenty disparate OpenID's. Users want one (or many that they have 100% control over). In other words, Google and Facebook will let you login to other sites with your Google or Facebook id, but neither will let you login to their own sites with other identities.

Quote from: indicasteve on July 05, 2011, 02:31:03 PM

I bet at least 50% of my potential users would run away if they needed a google account to log into my site. What do you think?

As much as I like Google, using their authentication method for money gives me the willies. Depends on what your plans are. Maybe it's just a proof of concept and you can take it from there.

indicasteve

full member

Activity: 140

Merit: 100

Quote from: netrin on July 05, 2011, 01:21:41 PM

Quote from: lebuen on July 05, 2011, 03:11:41 AM

International mailings are slow, expensive and barely reliable. This is something your local bank might be able to do, but not Mt. Gox or Tradehill.

I would like to see more federated authentication (OpenID). Then, whether we authenticate with PGP or mailed TAN, we can use the same authentication token for many services in the bitcoin community. Services like OpenID haven't taken off due to the chicken-egg problem. Well, we're a huge clutch of chickens! let's lay some eggs.

I'm making an app on google's appengine and was considering using OpenID for user authentication....researched it quite a bit, but openid on appengine dont work with https... so that kicks that idea to the curb for now.

Google's own implementation of openid works on appengine https, but you require a google account....and I'm not sure everyone who uses my service would accept that....but i might go that route anyway due to the complete ease of implementation and the fact that all the messy bits are taken care of by someone else. If true openid over appengine's https becomes available, i could then easily add that....but for now, a google account is required afik.

I bet at least 50% of my potential users would run away if they needed a google account to log into my site. What do you think?

netrin

sr. member

Activity: 322

Merit: 251

FirstBits: 168Bc

Quote from: lebuen on July 05, 2011, 03:11:41 AM

International mailings are slow, expensive and barely reliable. This is something your local bank might be able to do, but not Mt. Gox or Tradehill.

I would like to see more federated authentication (OpenID). Then, whether we authenticate with PGP or mailed TAN, we can use the same authentication token for many services in the bitcoin community. Services like OpenID haven't taken off due to the chicken-egg problem. Well, we're a huge clutch of chickens! let's lay some eggs.

JohnBigheart

full member

Activity: 167

Merit: 100

I am posting this on behalf of dsp(http://forum.bitcoin.org/index.php?action=profile;u=31526) a newbie who is restricted to the Newbie forum:

Quote

Cant post to this thread: http://forum.bitcoin.org/index.php?topic=25982.0
Want to post a link to one of myprojects:
http://www.otp2fa.com
I Sent this to mtgox told em they could use it for free/cost.

Original post is here: http://forum.bitcoin.org/index.php?topic=26124.0

cloud9

member

Activity: 126

Merit: 10

Quote from: kseistrup on July 05, 2011, 03:29:09 AM

Quote from: cloud9 on July 05, 2011, 03:21:36 AM

Only the User owning the username can send the 0.01wxyz number of btc from the associated address to his account with the service provider (he owns the wallet.dat and only him can send from the associated address)

While the idea that only the owner of the wallet can send from said address sounds nice, I'm sure this will cost endless grief in real life. For one thing, users of online wallets cannot use this system, and users that have their own wallet really have to know what they're doing in order to send from a certain address. It may be secure, but certainly not user friendly.

Cheers,

Here comes the opensource implementation bitcoinjs (webcoin), a webbased java client to the rescue , allowing bitcoin webservices where you keep your eeny, weeny, tiny kilbytes wallet.dat file on your local machine and separated from the gigantic, bulky, chunky, monstrous soon to be gigabytes blockchain file which is now for this service kept centrally on a server (and this centrally kept blockchain can be verified against other sources of the blockchain for the paranoid).

kseistrup

hero member

Activity: 566

Merit: 500

Unselfish actions pay back better

Quote from: cloud9 on July 05, 2011, 03:21:36 AM

Only the User owning the username can send the 0.01wxyz number of btc from the associated address to his account with the service provider (he owns the wallet.dat and only him can send from the associated address)

While the idea that only the owner of the wallet can send from said address sounds nice, I'm sure this will cost endless grief in real life. For one thing, users of online wallets cannot use this system, and users that have their own wallet really have to know what they're doing in order to send from a certain address. It may be secure, but certainly not user friendly.

Cheers,

cloud9

member

Activity: 126

Merit: 10

With the 0.01wxyz 0/? confirmation bitcoin login - only the user owning the username knows what wxyz the service provider requires (displayed in https),

and

Only the User owning the username can send the 0.01wxyz number of btc from the associated address to his account with the service provider (he owns the wallet.dat and only him can send from the associated address)

Thus ensuring trust with the Bitcoin network at no cost - to enable trusted second layer login in addition to username, password combinations. The waiting time should not be that long for the 0/? confirmation to propagate through the distributed/decentralized bitcoin network from the user to the service provider - mostly instantaneous. Double spending is not of importance in this instance. The balance of the user's account with the service provider can be adjusted only after more confirmations, enabling the user to transfer the random bitcoins again for other uses.

lebuen

full member

Activity: 126

Merit: 100

Quote from: MikesMechanix on July 05, 2011, 03:04:59 AM

One-time-passwords don't need to be that strong.

The cheapest way is to periodically print out and mail sheets of indexed TAN to the user. Make it four digit index and six number passcode or something like that and it's plenty strong and still easy to use.

Never really saw the need for electronic gadgets to do the above.

International mailings are slow, expensive and barely reliable. This is something your local bank might be able to do, but not Mt. Gox or Tradehill.

MikesMechanix

member

Activity: 70

Merit: 10

One-time-passwords don't need to be that strong.

The cheapest way is to periodically print out and mail sheets of indexed TAN to the user. Make it four digit index and six number passcode or something like that and it's plenty strong and still easy to use.

Never really saw the need for electronic gadgets to do the above.

cloud9

member

Activity: 126

Merit: 10

The cost in bitcoins of the 0.01wxyz btc login pin 0/? confirmation scheme would be zero as the 0.01wxyz btc gets transferred to the owner's own account at the service provider anyway (the owner of the bitcoins being the service user attempting to login by transferring the random agreed number of bitcoins).

But regardless, at worst 0.019999 btc = ~0.29US$ at present, and 0.010000 btc = ~0.15US$.

This number of bitcoins can however be transferred back to any address the owner likes as it has remained his property - it is just temporarily used to verify ownership of an address on file with the service provider (and thus verifying account ownership - whether anonymously or not).

cloud9

member

Activity: 126

Merit: 10

Quote from: kseistrup on July 05, 2011, 02:46:51 AM

Quote from: cloud9 on July 05, 2011, 02:42:19 AM

Please note that both transfers for login purposes can be sent without transfer fees as they exceed 0.1 btc minimum.

That would be BTC 0.01, right?

Cheers,

I'll correct, thanks!

error

hero member

Activity: 588

Merit: 500

Quote from: cloud9 on July 05, 2011, 02:48:36 AM

Quote from: error on July 05, 2011, 02:45:53 AM

Quote from: cloud9 on July 05, 2011, 02:42:19 AM

Wouldn't the easiest two factor login for Bitcoin not just be to:

On registration you give a bitcoin sending login address you own to the service provider, for example 13Ycm33vMGUo2HCu87pXZtqNapx8Cjjhb1. To confirm that it is actually you attempting to login, the service provider gives a four digit random number , for example 5783 - and he confirms your identity on 0/ confirmations when you've sent 0.15783 to the service provider's associated address for your account FROM your bitcoin login sending address (registered for login purposes and on file with the service provider), ie. 13Ycm33vMGUo2HCu87pXZtqNapx8Cjjhb1 . The service provider confirms from the blockchain that you did sent 0.15783 from your address on file with the service provider, ie. 13Ycm33vMGUo2HCu87pXZtqNapx8Cjjhb1 , and allows you access (because as the owner of 13Ycm33vMGUo2HCu87pXZtqNapx8Cjjhb1 only you should be able to actually spend from this address).

Please note that both transfers for login purposes can be sent without transfer fees as they exceed 0.1 btc minimum.

There's no real way right now to send coins from a specific address.

There is - you just spend all your coins in your wallet to a certain address in your wallet that you own and it consolidates into the destination address and empties all other addresses.

OK, then you either have to wait to spend any more bitcoins, or pay a transaction fee. Or wait hours for it to be confirmed. As an authentication method, this certainly doesn't seem workable.

Topic: an idea for easy two-factor authentication (Attn: Mt.Gox) (Read 4032 times)