We’re at Carnegie Mellon for the Spring CSG meeting. The first workshop is about “Life in
Password Security: How Safe Are Our Passwords – Richard Biever, Duke
Intro to passwords: How are they stored? What are hashes? What are the problems with hashes? (not all created equal – see NTLM in Windows)
What risk are we attempting to remediate (e.g. phishing or cracking?) (see https://haveibeenpwned.com/ )
Password Cracking: Methods of Attack: Brute Force; Brute Force with a mask (i->1, e->3, etc); Dictionary; Rainbow Tables (precomputed hashes) – gpu s make it easier to compute.
Vulnerabilities: Length, Type (passwords or passphrases), complexity
Password policies and entropy – higher entropy -> harder to guess, but harder to use. NIST 800-63v102 defines some standards. User chosen passwords are less entropic. User chosen 20 character password has less entropy than a random generated 8 character pw
Attack Dynamics: offline attachs against exfiltrated hashes. Microsoft hashes easiest. Modern GPU are fast – P50 = 14.7. billion hashes/sec – defeats 33.5 bits of entropy every second! Gets even faster if you use cloud GPUs.
Moving forward
Authentication strength: More than password strength: MFA for everyone. Vision – when you hit a shib web site, you should be able to use 2FA plus certificates. There’s a new standard called WebAuthn where you can use your phone as a token.
Ongoing projects: MFA for everyone – complete; MFA for VPN – complete; evaluating current password policy for security + user-friendliness; certificate management as a new factor in authentication strength.
Mark McCahill – Investigating Facial Recognition – now on smartphones (wouldn’t depend on just that one factor); needs high res camera, computer, fast network. Person database with ZGPU and machine learning moel to return inferences based on person database. Duke researcher Guillermo Sapiro’s group: ~150 ms latency for facial recognition ifnerence run on 100k faces.
Early POC project – facual recognition on doors – cheap sensor (raspberry Pi + 8 megapixel camera module + power supply (~$100 total) can stream video to inference engine and unlock the door. Issues: live detection via stereoscopic images? Gesture? Others? Consistent illumination? Neural Comput Stick – gigafflops on USB. Intel USB Movidius – 1 watt of power, 100 GFLOPS, 10 inferences/second in continuous inference mode, $79 retail. Move processing to the edge.
Survey Results – Tim Gleason (Harvard)
- Do you believe that a long multi-word passphrase is sufficient? 78% said no
- Do you use a personal Password Manager? 71% yes – lastpass most often cited.
- How many passwords saved in your personal password manager ? 249 median (was 80 in 2016 meeting)
- Is your password manager protected with 2FA – 54% yes.
- What types of second factors are permitted?
- Push on phone 23%
- text message 17%
- telephone call 21%
- hardware token 22%
- u2f fido tokens 11%
- other 3%
- do you use certs for personal authentication? 20% yes
- Have you had a central AD hack? 25% yes
- Has your institution been bitten by payroll bank account transfer attacks? 58% yes
Tim Gleason – Harvard
Password policy and standards (https://policy.security.harvard.edu) : Includes data classifications based on risk, password requirements, multifactor services; network positioning and protections. NIST 800-63B provide reference model. Harvard’s polcy states “all users are responsible for protecting their Harvard passwords…” Policy requires different passwords must be used for Harvard and non-Harvard accounts, and no shared passwords.
Three options for password complexity: HarvardKey (web auth system); Passwords > 20 characters; or < 20 characters with a bunch of complex options. They don’t expire passwords.
Deployed DUO in 2016, required for most services in 2017. LastPass Enterprise – free for Harvard affiliates.
Support Challenges: Single identity for life philosophy; Identity proofing is a distributed function between offices; HarvardKey enrollment.
Password recovery is generally self-service; lost or misplaced DUO tokens can require helpdesk interaction; user community is 24/7 challenge for identity proofing.
4 methods utilized by support teams to remote id: . phone number, in-person, ask person to take a selfie and compare to official photo, trusted third party.
Consderable room for improvement in the user support experience.
A Decade of PKI – Jim Jokl, UVa
Why PKI? Stronger normal authentication for common applications, for use by everyone. Also strong authentication for sensitive data access.
Digital Certificate – bind identity of a person’s public key to their identity, signed by a certification authority.
Chose to do two difference Certificate Authorities – standard assurance, targeted for standard apps; and a High Assurance CA – offline CA using hardware crypto modules, uses a hardware token, requires in-person identity proofing. A few thousand in use at any one time.
High Assurance CA applications – VPN (each user gets a custom network filter for which apps they can access); System admins (ssh and web authentication for network management)
Standard Assurance CA apps – web authentication, VPN, Wireless, S/MIME for signed and encrypted email (not common nor encouraged).
Developed a provisioning tool that provisions certificate and wireless, VPN settings, security settings, and network registration.
WebSSO – most people have certificates on their devices so web authentication is easy to use. Still not used for most web logins.
Started process to migrate from home-grown CAs to SecureW2. Commercial product for standard assurance provisioning and CA. SecureW2 hosted web services provides: provisioning, configuration, SAML Authn.
Goal to switch to InCommon/Comodo for issuing certs. May end up using SecureW2’s CA instead.
Passwords Are Weeds – Stories from The Farm – Scotty Logan (Stanford)
June 2013 – HIPAA breach. Moved to required laptop encryption, then device management
Mid 90s – Built WebAuth SSO.
In 2011 built a two-step authentication system.
2013 – made everyone change passwords, and then AD was hacked so made them do it again. Made two-step mandatory for everyone. Late 2014 switched to Duo (keeping their old UI).
2014 – Meeting about IPv6 addressing and 802.1x for network authentication. Decided to use certificates. One per person, or one per person per device? UX advantages (no no need to transfer keypairs between devices, a lost device doesn’t affect other devices, can identify device in addition to person and associate device status with cert).
2016 – WiFi and Radius – passwords still terrible, but Duo mitigates Phishing. Still using WebAuth but no developers left; Increased use of SAML 2.0 from external providers; certificates for WiFi authentication and device management in place.
Built certcache – another CA – root provate key ever stored as a shole; CloudPath sub-CA issues certs to device/person pair. Data for associated devices stored with each certificate. CLoudPath calls webhooks when cert issued / revoked. Use AWS API gateway to transform URL into SQS message – no active code, configuration in Terraform. CertCache receives notifications from SQS, queries CloudPath for certificate details, stores in MySQL. Certificate status set to “unknown” while BigFix updates details. Cert -Authn only allowed if status is “ok” or “unknown” (within seven days).
Late 2016 – concern about authentication after an earthquake. Switch to SAML 2, ditch webauth, What about WebLogin? – becomes just another SAML relying party.
2017 – work on migrating to containers on AWS.
Current Status – RADIUS: Cert authn VPN profiles in production – authz: CertCache (device status), LDAP (account status); Containerized; Still on campus but so is VPN service – going to investigate RADSec; VPN logs go to SUNAC for finer-grained network access.
Current Status – WebSSO – Migrating everything possible to SAML 2.0; WebLogin behind the IdP, still only on campus; WebSSO and supporting services running in AWS, but masters still on campus.
Going to disable text message and voice message 2FA (easily hacked formats) for some populations.
Phillip Kobezak, VaTech
Got into PKI around 2006 – lot of documentation and procedures, three CAs. Used Aladin eTokens for personal digital certificates – required in-person identity proofing. Used for limited populations. Started having support issues because vendor used specific functions in browsers that were falling out of support. In 2009 started using Vasco tokens with one time passwords.
Did a separate CA for wireless certs, operated for several years as primary wireless authentication until eduroam became popular. Now is shut down, but still use a separate identifier for the network.
Personal Digital Certs – now issuing self-service distributed online. Including key escrow. Uses: S/MIME email and project documentation signatures; Encryption of PDFs, including portfolios.
Two Factor deployment with Duo: 2013 AD compromise pointed out need for stronger auth. Duo on enterprise directory, AD, and VPN for all users, including alumni. Still need to address dsektops/laptops.
Path forward: evaluation of additional password-less approaches. Specifically interested in device registration with certs.
Oren Sreebny 