Locking Pin Systems
A classic strategy to defend against Personal Identifica-tion Number (PIN) guessing attacks in authentication to-kens is to lock the system after three consecutive invalidPIN attempts. However, this classic strategy could seri-ously undermine the system usability. After the PIN hasbeen locked, it can only be unlocked by the token Ad-ministrator. Actually, that is the worse-case scenario of usability once the administrator is not available, the useris blocked and no reversible action is possible.
Cumbersome Data Input of Challenge ResponseCalculators
Challenge-response calculators (CRC) require even moredata input in comparison with other authentication meth-ods such as a user ID, a password, a PIN and a "chal-lenge" (e.g. an authentication server creates a "chal-lenge", which is typically a random number sent to theclient machine). Therefore, the difficulty and the prob-ability of data input errors are higher (i.e., CRC do notecho the password back on the screen as it is typed, orthey only display asterisks in place of the actual charac-ters).
No Usability Features of Public Key Infrastruc-ture (PKI)
In order to illustrate the usability issues in a user authen-tication method, let’s briefly present the "Usability of Security: A Case Study" [11] which was performed toevaluate the usability of Pretty Good Privacy (PGP) 5.0.The PGP is a standard software, which uses Public KeyInfrastructure to encrypt, decrypt, and digitally sign data,for the encryption of Electronic Mail developed by PhilZimmermann [12]. The authors choose PGP because ithas a good user interface according to established stan-dards, and they claimed to find out whether that was suf-ficient to allow non-programmers who know little aboutsecurity to use it effectively. The results obtained througha cognitive walkthrough and user testing show that usershad difficulty to: avoid dangerous errors, encrypt a mes-sage, understand the public key model, figure out thecorrect key to encrypt with and how to encrypt with anykey, decrypt a message, publish the public key, and fi-nally verify a signature on an email message. These are just the basics tasks to be performed in order to executecorrectly the program. Therefore, PGP is not sufficientlyusable to provide effective security for most email users,according to the authors, because of the fact there is a"mismatch between the design philosophy behind its userinterface, and the usability needs of a security utility".
Redundancy Factor of Biometrics Systems
The best practices in the authentication area state thatmulti-factor authentication (i.e. more than one form of credential to identify a user) is generally stronger thanany single-factor authentication method. Biometrics (i.e.recognition of one’s hand, iris, voice, etc.) is generallyrecognized as a "good candidate" to be used with anotherauthentication technique – a two-factor authentication; ina two-factor technique (e.g. coupling biometrics withsmart card technology) the "redundancy" of the authenti-cation augments the security level, but at the same timediminishes the user experience. Furthermore, there canbe serious limitations with some biometric measures (e.g.there is a range of eye diseases that affect the capabilityof iris recognition system to capture an appropriate im-age of the eye [4]) and the level of social acceptability.In such cases, the authentication process must be built in
redundancy,
so that a second method must be providedin order to confirm the identity's user. However, an au-thentication process also involves a user being enrolledand verified. Hence, we should focus on enhancing userexperience and convenience when choosing an authenti-cation method.
Comparative Analysis of the Authenticationmethods
As part of this project, we developed a comparativeanalysis of the different features encountered in authenti-cation methods according to Table 3. To describe the fol-lowing features we make use of subjective rating scales:"Security" and "Usability" (ranging from 1=Minimum to5=Maximum in order to measure the degree of severityissues related to each authentication method), and"Automatism versus Human" (ranging from 1=Human isbetter; 5=Machine is better). The feature "Accuracy" hastwo measure rates of authentication by biometrics:(i) False Reject Rate (FRR) where a legitimate user is re- jected by the acquisition device; (ii) False AcceptanceRate (FAR) where a false user is accepted. The "AverageAttack Space" (AAS) corresponds to the number of guesses made by an attacker in order to disclose the se-cret (e.g. passwords, PINs, etc.). Abbreviations used inthe Table 3: PK=Public Key; PRK=Private Key;SSO= Single-Sign-On; TGS=Ticket Granting Service.
Authentication Methods - Vulnerabilities stillremain
Despite the efforts that were made by organizations toprovide suitable authentication methods, vulnerabilitiesstill remain. Mechanisms and models that are compli-cated to the user will be misused. When an authentica-tion method is too demanding the user might not keep upwith the increasing workload (e.g. a user might refuse tochange her/is password each time s/he logs on). Thus,organizations tend to blame mostly users for the humanfailure of not handling complex and demanding technicalsystems. However, Norman argues that what we oftenview as human error is the result of design flaws that maybe surmounted [8]. According to Computing TechnologyIndustry Association CompTIA [3], the human errorturns out to be the principal cause of security breaches inthe computing security sector of organizations; they ac-count for 84% of security breaches in 900 private andpublic American organizations.
Leave a Comment