Published:
February 16 2011, 11:46 AM
|
3 Comment(s)
by
Jim Reno
I'm attending the RSA conference in San Francisco this week, a yearly event for me the past ten years or so. Walking from my hotel to the conference I always feel self-conscious, because hanging on a lanyard around my neck is this badge holder the size of a paperback, festooned with advertising and ribbons, indicating I'm a Blue Delegate and in the Member's Circle and five other things. I feel like a kid whose mittens are tied together with a string through his coat, and have his name stenciled on them in large letters. Or perhaps like I have the word GEEK tattooed on my forehead. This isn't good because I became a geek years ago in the pre-internet days before Geek became Chic, and it wasn't pretty.
It occurred to me that the badge holder is essentially a form of authentication. It's supposed to be the actual badge inside the holder, but it turns out most of the door guards - and at the conference they enforce pretty viciously - are trained to look at the holder, not the badge. It has to have the right shape and the right word and color stripe across the bottom to get into certain sessions or the show floor. But in a conference dealing with the latest advances in security, it's a form of authentication that was probably exactly the same as that used at conferences in the 1950s, maybe even long before that. Plus it's one more thing I have to carry and feel embarrassed about when I'm ordering my latte at the Starbucks on 4th.
Why I can't simply use my mobile phone to generate an authentication token for access to, well, anything? Especially since that device is always in my pocket - or more likely in my hand - which causes me to walk in front of traffic and trip on carpets. The fact is - I can use my mobile device for authentication with our mobile authentication application featuring CA ArcotOTP. CA ArcotOTP is an app for your mobile phone - pretty much any phone, smart or "differently abled" - that you use to generate single-use passcodes. These passcodes are generated using standard algorithms like OATH or EMV/CAP, and can be validated using CA Arcot WebFort server, or any standards-compliant OTP (one-time passcode) server.
We think of things like passwords and OTPs as useful for online authentication, like logging into a portal/VPN, or authorizing an online transaction like a purchase or a money transfer. They go well beyond that, because a lot of things in the world use a simple PIN or password to control access. Part of the reason these PINs/passwords are a problem is because they don't change. You've probably been using the same ATM PIN for years. That gives an attacker a long time to discover it, and once discovered, a long time to use it. Even if you changed your PIN every month, he'd still have (on average) fifteen days to use it before it changed. A single-use code avoids this problem because it's only good that one time. The bad guy can be looking over your shoulder, or reading your mind, or you can just tell him: "Hey, I'm using code 554642 for this transaction", and it doesn't do him any good, because 554642 is never, ever going to be valid again.
So CA ArcotOTP gives me a two-factor authentication token that's flexible, easy to use and best of all is based on something I already have in my pocket - my mobile device. Ah, you say: I'll just steal your phone and break into the app. Sorry, but the underlying keys CA ArcotOTP uses to generate the passcodes are protected with our Cryptographic Camouflage technology: getting them does the attacker no good.
I think about all the places in my life - both virtual and physical worlds - where I use some kind of authentication technology to access something, and I wonder how something like the CA ArcotOTP technology could make them easier, or help me carry around less stuff. Why do I still have house and car keys? My phone and car already talk to each other using Bluetooth; I should be able to generate a single-use code on my phone and open the car. Or open a door. Or log onto a VPN. Or buy that latte.