Re: [Fed-Talk] Filevault and FIPS
Re: [Fed-Talk] Filevault and FIPS
- Subject: Re: [Fed-Talk] Filevault and FIPS
- From: Allan Marcus <email@hidden>
- Date: Fri, 19 Dec 2008 14:44:17 -0700
There is a simple mitigation: checkpoint's recover password is only
good for one time use. The user's computer gives the user a code to
read to the help desk. The helps desk enters the code into the server.
the server generates a one time password. the user uses the one time
password and gets into the computer. Anyone listening on the phone
cannot use the password again.
---
Thanks,
Allan Marcus
505-667-5666
On Dec 18, 2008, at 2:08 PM, Wm. Cerniuk wrote:
Sending via email would be worse, but I see your point that over the
phone is 100% secure either...but is it adequately mitigated by the
fact that it expires when the system makes contact?
As an alternate, a remote reset could also be compromised. If the
comms went across the network using say SSL/TLS, it could be also
easily be captured.
How to solve the problem in a better way? Could it simply be a
policy (human being) issue? Many argue passwords are not secure
because users write them down. Does this really boil down to PEBKAC
and needs to be fixed in the same place?
Is it legitimate to dispose of PGP as an insecure solution because
of a potential misuse of the functionality?
V/R,
Wm.
On Dec 17, 2008, at 7:04 PM, Allan Marcus wrote:
The difference between the user's PW and the recover PW is the
recovery password is verbally told to the user over the phone. This
communication can easily be captured by a malicious person. So, in
essence, the recovery password can be compromised easily.
---
Thanks,
Allan Marcus
505-667-5666
On Dec 17, 2008, at 12:31 PM, Wm. Cerniuk wrote:
Here's the problem, the recovery password is still valid until
the computer connects to the home network and talks to the PGP
server.
Essentially the recovery password becomes another password for the
user until the user logs in and the password dies. The user's
password is active from that point forward. The reset password is
active until it gets to a network connection.
The user is in control of both password equally until the reset is
taken away. Can the user do something different with the reset
password that they have not done before ... or that they cannot
with their password? Isn't it essentially a temporary password
to protect like the normal one?
V/R,
Wm. Cerniuk
On Dec 17, 2008, at 1:50 PM, Allan Marcus wrote:
PGP has a fatal flaw, IMHO. If the end user forgets or needs to
have the password changed, the end user calls the help desk. The
help desk simply looks up the end users computer in a database
and provides a recovery password. The end user uses the recovery
password and can reset her own password. Here's the problem, the
recovery password is still valid until the computer connects to
the home network and talks to the PGP server.
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Fed-talk mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Fed-talk mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden