** problem ** the MAID is safely stored in the users head, but a key logger on your own machine or the machine in a public space could easily capture your login data and give access to all your information.
This follows from the two lengthy threads "DOS attack’ and ‘proof of unique human’, so I thought it best to start a fresh topic.
** partial solution 1** the use of external ‘trustworthy devices’ to authenticate.
Trezor (http://www.bitcointrezor.com) for the bitcoin wallet is interesting; but it would have to be redesigned specifically for SAFE, and should include at least some kind of PIN, or fingerprint to validate the proper user. (if not, losing it your whole digital life can get stolen.)
Nymi (http://www.getnymi.com) is another very interesting product, in particular for the Anonymous ID from SAFE. I didn’t like this project before (as it’s not open source) because I don’t want to be wearing a wireless dog tag that shouts continuously who I am. But MAYBE with an anonymous ID it could work: you still type in your MAID but the password is done through signing a challenge from the network with the private key (of a braceletMAID, not the main MAID) inside the bacelet?
** partial solution 2 ** : I still love voice print recognition
after logging in, you give a voice password, (some hash of which) should match the previously left voice password. So every time you log in, you speak two words: one of them is new, the other one should match the new one from last time. As I write this, I realise it’s pretty bad: the computer you use to log in can record your voice as easily as the keystrokes, so it has a 50% chance of replaying the right word :). This needs a better strategy !
** partial solution 3 ** it’s not user friendly, it is neither a super strong protection, but it might be better then nothing and importantly, it doesn’t require any high tech solutions: a Caesar cipher on the pincode
Instead of asking a user to fill in his pin code, the user could opt to fill it in with a Caesar cipher: the client displays “add X to every digit (modulo 10 of course)”. Granted again this is a ridiculously weak suggestion; it would only take 10 attempts to get the right pin code afterwards. Adding a random number to the pin mod 10.000 is probably a bit too difficult as a challenge to log in
** partial solution 4 ** after logging in, the client picks a random (simple) word from the dictionary and displays it. This word you have to remember to log in next time. And with every log in on a non-trusted computer it changes; and preferably you reset your password after the use on the non-trusted computer too.
I’m abandoning user-friendliness for the sake of brainstorming on low-tech ways to evade standard easy attack vectors, ie key loggers (screen recording is a different question)
@dirvine Didn’t I see somewhere that you had talked to Steven Sprague from rivetz? I spoke to him at some length at the Texas Bitcoin Conference. There is already hardware built into most modern machines which can be use to defeat keylogging but the access to the interface is not implemented as yet. At least that is how I understand it. I’ve got his card if you don’t have his contact info.
Oh sure and if someone reads your “anonymous” ID while seeing who’s attatched to it it ceases to be anonymous. If it was shouting a MPID that might be different since those are disposable but your login credentials would be a real problem.
It’s important to note that keystrokes can also be recorded through the accelerometer from a (hacked or planted) smartphone close to the keyboard on the same table. Up to this day, no phone asks permission for an app to access the accelerometer in the phone even.
The more I think about it, we should build a protection that (if desired) assumes every computer has a key logger.
I came up with a system on my way home from work today. Let me know what you guys think about this process. It seems relatively user friendly (than some suggested methods anyway) and I think reasonable to expect people to use for a secure system. This also takes into account that if you are specifically targeted, people WILL find a way to get your info. This is to prevent the vast majority of attacks.
To help again keylogging - layer 1:
When the user is entering their username and password, their password input is salted with a captcha shown on the screen. The captcha is any random data pulled off the encrypted network. The first/last/middle 3-9 characters of a chunk (the actual encrypted data, we don’t care what file its from or anything like that. Just salt data). The user is told to add that at the beginning or the end of their normal password.
Why?
This will require your password to be logged and analyzed more than once. I think it is a minor inconvenience for making mass password logging a little harder.
After the user has logged in - layer 2:
The user is presented with their unique picture they will recognize (they upload it, network picks it, whatever) and a pin pad. They must click the numbers in their pin number. If they must type, they can use the keyboard, but the mappings of key->number changed every time and the numbers are in different order every time.
Why?
The mappings change and number change positions between logins to prevent keylogging and courser location attack routes. Having the unique picture and having the user click force an attacker to screen capture a lot of data that would be rather hard to have a computer go through and pull out the data you need. So they’d have to sift through a fair amount of data making it frustrating to en-mass pull data from a large group of users. I hope its obvious that if the picture is wrong, you shouldn’t enter your data anyway.
Again, targeted attacks are going to happen, but i think this makes the cost-reward for an attacker much to great (for the time being) to try and use a botnet to keylog AND screen capture a lot of people and sift through the data. Using these two techniques together will make fishing attacks VERY hard.
How about entering the password with your mobile phone? Or no password at all, but instead a signature with a secret key?
The page displays a 2D barcode, you read it with your mobile application (or maybe with a HW key dongle some day…). And you are logged in.
Here is a demo: http://cave.dy.fi Maybe something like this could be used?
I’m currentlly working on passwordless mail service based on this.
The SAFE network is exactly anonymous. It doesn’t know who you are, so it cannot send you sms codes, or email codes or anything. The network doesn’t know who you are. The point is exactly that you can identify yourself anonymously.
I’m not even mentioning that the phone network is about the most surveilled channel you could possibly think of using.
How about have the maidsafe account linked to an altcoin address and generate a new recieving address to send an altcoin transaction too every new login attempt. Any transaction made to the recieving altcoin address that is from the linked address opens the account.
So it asks for your password then it says “waiting for an altcoin transaction”. Once you make the altcoin transaction, it opens the account. Should be set to 0 confirms.
Another proposal from last week on how to avoid key loggers is - quite hard to read - is here
It has the nice feature of relying on the human brain to ‘extend’ the verification chain, so it doesn’t end at the client-terminal. This basically makes key logging useless (although if your credentials are compromised it is recommended to change them). Additionally at the same time it solves the problem of bots. Bots can neither create or login to an account.
There is still (at least) one issue to resolve with the current proposal. I’ll try to write it out self-contained and clear, and hopefully we can find an elegant solution to those last problems too.
Of course key fobs in their current implementation couldn’t be used because they would require to have the network hold a private key in plain text.
We might however keep the idea of a small, dumb electronic gadget that spits out encrypted data. Only, it would take challenges from the network and print out the result.
But I’m not sure there’s much of a point to it anyway. If your machine’s owned, attackers won’t stop at your password. ‘Keylogger’ is a catch-all term, but many of them do way more than logging key presses. Once you’ve logged in, they’ll have access to all your secondary private keys, no password required. If your machine’s compromised, it’s over.
That’s the beginning, later there can be a browser addon, (like certificate store), and even HW token. Actually, it would be quite universal; a HW token (maybe running android) which has only one button, a webcam and a network (or bluetooth) connection; It stores the crypto keys, reads 2D sign-in barcode and sends the signature to open (www-site? a door? start a car?) the account.
I agree, but I think the problem is split into two separate issues. There is the following chain of ‘locations’:
SAFE network <–1–> client software in OS (2) <----> (OS and physical space) between client and human <–3–> human
1 is the responsibility of the SAFE network, securing the connection between the client and the network
2 you need to be able to verify the client is authentic software running in the OS - a usb stick with read only software could verify the binaries of your client you want to execute on the machine (in some way, not all details clear)
3 the brain key (similar to a key fob, but a brain can’t get stolen and everyone already has one) adds some additional protection against a simple recording of your password.
The question you rightfully ask still is, how strongly can the secondary keys and datamaps be shielded in memory by the client and the OS from attacking software in the same computer?
Signum soft keylogger features had proven to be an excellent solution control and motivation at work of all employees. The fact is that the control and supervision of all employees in large companies is almost impossible to always maintain a reasonable level, due to the large amount of work and the simple inability to be with the employees while working.
