week's reading mentioned various methods of approach to account recovery

Account Recovery is Hard

• “Forgot your password?” there’s many ways to get back into account – Most are substantially less secure than a half-decent password – Most are always accessible to attackers • Goal: account access, not password recovery! – Who cares about the old password? – Password recovery implies cleartext storage • Many technical choices – Email, social authentication, knowledge based (secret questions, public records, etc)

Email Alternate Authentication

• Email a new password or access token – “Obviously” you can’t mail them old password • Threats – Information disclosure (eavesdroppping, attacker access to email) – Denial of service (customer no longer has access to the email)

Knowledge Based Authentication (KBA) • “What’s your password” is one end of the spectrum – Ideally, known only to you and customer – Unfortunately, often shared or forgotten • Leading to – Secret Questions – Public records (aka “out of wallet”) – Data only you should know (“Tell us how much we just deposited into your account.”)

Issues with KBA

• Security – “What color are your eyes” has few answers – Names are differently popular (Mike vs Lawrence) – Mothers maiden names on genealogy websites – Et Cetera • Usability – Applicability – not everyone has a first pet – Memorability (was Ms Robinson 1st or 2nd grade?) – Repeatability (Main Street vs Main St)

Social Authentication

• Passive: Identify these pictures of your friends – Easy for you, hard for an attacker (we hope) – Threats: friends with pictures of their pets, pictures with name badges • Active – Account trustees can help you get back in – Takes longer – You may no longer trust your trustees

Names

• Get tricky for computers – Which Tom Jones? – “mom” • Real names don’t help you with security – People are still jerks – Policing risks offense • Secure, human meaningful, decentralized: pick two

Meaningful ID

• Calls to mind the right person for the user • Requires knowing the person • The person that “mom” calls to mind is different for each us us, and that’s ok • Must be presented in a way that’s hard to spoof • ID documents are opposite of meaningful ID

Social Security Numbers

• Used as identifiers and authenticators – This is an awful pattern – An authenticator known to many parties and not subject to change is a bad pattern • Bad as a database key • Not everyone has one • These problems generalize to other identification schemes

Identity Theft

• Often just another name for fraud by an impersonator • Sometimes much worse – Database records intermingled and confused – “The computer is always right” – Reputational damage • Be careful linking data from various sources • Be careful when you correct data not to allow another source to override it – If Alice proves she’s not a deadbeat, don’t mark her as one based on the previous (bad) source