Re: About the authenticator

On Feb 4, 4:59 pm, chocolatemalt <m...@xxxxxxxxxxxxxx> wrote:
In article
<58c868f9-95eb-4def-a578-f57bc502d...@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>,



 cryptoguy <treifam...@xxxxxxxxx> wrote:
This is actually an area where I am expert. I used to work on SecurID
authenticators from RSA Security. SecurID is the industry leader in
two factor authentication products. I actually wrote many of the
software versions.

The Blizzard authenticator is from VASCO, a smaller company with an
(imho) less sophisticated, but cheaper, product.

The main point I'd like to make is that the serial number you type in
when registering the authenticator is not related to the key that is
actually used to generate the passcode. The key is a long random
number, stored inside the authenticator. At the time the authenticator
is manufactured, the random key is assigned, as is the serial number.
The serial number is stamped on the outside; the key is stored in the
device's memory. Knowing just one, you can't derive the other.

The serial numbers and their associated keys are also stored in the
authentication server used by Blizzard. When you register the
authenticator, you send your account name and the serial number of the
authenticator. This is stored, and used to look up the key needed to
derive your passcode. If the passcode sent in matches the one
expected, your are authenticated.

Even if the algorithm became known, it wouldn't help an attacker much,
since he/she would still have to figure out your key. (Look up
'Kerchoff's Principle") The key is long enough that a brute force
search is impractical.

I assume there's a way to read that key off the authenticator itself?  

I can't speak for Vasco products, but no, it would serve no purpose to
have such a backdoor.

Or does the circuitry only allow a write and is engineered to
self-destruct (or just erase data) if electronic access is attempted?

I'm restricted in what I can discuss, but there are a lot of defenses
against various types of attack.

Of course no one is going to do that for a WoW account, but for bigger
targets like political or enterprise espionage, a PC-based keylogger
that intercepts the username and passcode along with a hardware reader
to grab the key off the authenticator, would be enough to create a copy
of the authenticator and the entire access mechanism.

The passcode is a use-once deal, so that doesn't help. There is no way
to get the key off of tokens I am familiar with without very expensive
effort, destroying the token. This isn't something that can be done
without the owner noticing, The owner would then call the security
office, and get a new token, revoking the old one.

High security systems use not only the number displayed, but a
memorized secret PIN. Stealing the token doesn't get you the PIN. Look
up 'Two Factor Authentication". Enter more than a small number of
wrong values, and logins with that token are disabled.

pt
.

Relevant Pages

  • Re: Blizzard password security
    ... It also looks like there's no delay between failed attempts. ... and use an authenticator which makes the password irrelevant ... Blizzard ... I'd imagine anyone sensible about security doesn't use their main ...
    (alt.games.warcraft)
  • Re: Battle.net Hacked
    ... But the authenticator makes it really secure to login....I will try changing again but I cant submit a ticket as its not letting me address the issue! ... our security team found an unauthorized and illegal ... American servers (which generally includes players from North America, ... I dont use a MOBILE PHONE.... ...
    (uk.games.video.misc)
  • Re: Account hacked :/
    ... There was also a newly created charachter, ... Guess I will need to get that authenticator after all. ... that your account is safe, the truth is that probably the hacker has not ... security tech for the military and has me Very well setup. ...
    (alt.games.warcraft)
  • Re: Keylogger Warning: Authenticators Now Vulnerable
    ... ready to type in the authenticator ... to somehow make my scenario fail as well. ... A high security financial/military ... So, sitting side by side, if read the code from your authenticator, I ...
    (alt.games.warcraft)
  • Re: Battle.net Hacked
    ... but i use a battle.net code authenticator to login so they cannot login without my code tied to my account with my authenticator??? ... our security team found an unauthorized and illegal ...
    (uk.games.video.misc)