text:
Authentication for People
- Buck Campbell
- 3 years ago
- Views:
1 Chapter 5 Authentication for People The challenge is to devise authentication methods that exploit the strengths yet accommodate the weaknesses of our human minds and bodies. Computers are great at doing cryptographic calculations and storing keys (arbitrary bit strings) for later retrieval. Humans are not. So cryptographic protocols, which work so well for one computer to authenticate another, are impractical when a computer must authenticate a person or when a person must authenticate a computer. Methods to authenticate an identity being claimed by a person are grouped by security cognoscente into three broad categories. Something you know. You demonstrate knowledge of a secret or fact(s) unlikely to become known to impersonators. Something you have. You demonstrate possession of some distinctive object that is difficult for an impersonator to obtain or fabricate. Something you are. You allow certain of your physical attributes to be measured, believing that corresponding measurements will not be similar for impersonators. Moreover, by using multiple authentication methods, our confidence in the result can be increased beyond what any single method provides. Users of bank ATMs are likely familiar with two-factor authentication involving something you know (a PIN) and something you have (a plastic bank card). Here, ignorance of the PIN makes it difficult for an attacker to benefit from stealing the bank card, and without possessing the bank card an attacker cannot benefit from learning your PIN. The general case is multi-factor authentication, where multiple independent 1 methods are used to authenticate a person. 1 Recall from the Defense in Depth discussion (see page 19) that two mechanisms are considered independent to the extent that an attack to compromise one is unlikely to compromise the other. 37
2 38 Chapter 5. Authentication for People Identity and Enrollment We define an identity to be a set of attributes. Each attribute is a statement or property about an individual; an attribute that is associated with exactly one individual (in some presumed population) is called an identifier. A given person is likely to have multiple identities (e.g., as a student, as a citizen, as a credit-worthy consumer), comprising various attributes (e.g., attends classes CS513 and CS481, is a registered Democrat, always pays bills) some of which are also identifiers (e.g., Cornell University student id is , social security number is ). You might think in terms of having a single identity comprising all of your attributes, but virtually nobody else views you in this way. Most people will know only a few of your different identities. And by keeping these various identities separate, your friends associated with one identity need not know about your friends associated with another. Anyone who has ever tried to stay friends with both members of a couple after they have ended their relationship will know the wisdom in being able to have distinct sets of acquaintances. Besides authentication, we might be interested in identification a process by which the identity of an individual is determined from attributes that have been claimed or observed for that person. Authentication takes as input both an identity and a set of attributes (and returns whether they match), whereas identification requires only the set of attributes as input (and returns an identity). A border guard who checks whether a passport names the bearer is performing authentication; a video surveillance system attempting to locate suspected terrorists in a crowd is performing identification. An identity is most useful if we can have confidence its constituent attributes actually hold for any individual authenticated under that identity. 2 An enrollment protocol, executed before the identity is added to the system, provides an initial validatation of these attributes. Some attributes can be checked electronically. For example, to create a new account at a web server, most of us have experienced a captcha (Completely Automated Public Turing Test to Tell Computers and Humans Apart), which is a challenge-response test that is easy for a human to solve but difficult for a computer. One well known captcha displays distorted images of character sequences that are too complex for state-of-the-art image recognition software but are easily recognized by humans. Other attributes can only be checked by initiating physical action or provding physical evidence. For example, Alice might demonstrate that some bank account is under her control by transfering $1.00 from that account to a specified third party; Bob might validate his name by presenting a valid driver s license and passport, where each contains a photograph matching the presenter s face. 2 For this reason, some authors prefer the term claim to attribute.
3 5.1. Something You Know 39 The design of enrollment protocols is tricky. Documents and other forms of physical evidence can be forged or altered. Moreover, documents that describe attributes of their subjects rarely offer proof that can be independently checked. A birth certificate, for example, contains no proof that the bearer is the one named in the birth certificate or that the claimed relationship between mother and child is valid. 3 Even the meaning of unaltered and valid official documents is frequently misconstrued. For example, increased confidence derived by requiring both a passport and a birth certificate is unfounded when these documents are not independent, as is frequently the case. 4 Vendors of authentication services typically offer a choice of enrollment protocols. The choices range from protocols for obtaining low-confidence judgments about the validity of the attributes, perhaps based on credentials submitted by mail, all the way to protocols that yield high-confidence judgments based on in-person interviews, physical examinations, or even background investigations. However, it is not clear how a computer system could leverage judgments about enrollment confidence, since it is the task that usually dictates the degree of confidence sought about attribute validity. A system is more likely to benefit from having a suite of authentication protocols than having a suite of enrollment protocols, since this enables obtaining the appropriate level of confidence about the identities involved in each different task. For example, banks and other financial institutions use multi-factor authentication for customers making large withdrawals but use a single low-confidence authentication protocol for customers making deposits. 5.1 Something You Know Knowledge-Based Authentication. With knowledge-based authentication, each individual, as part of the enrollment protocol, provides the system with answers to a set of queries; thereafter, to authenticate that individual, the system poses some subset of those queries and compares the responses it receives with the answers provided at enrollment. Archetypal queries concern an individual s family (e.g., What is your mother s maiden name? ), life experiences (e.g., In what cities have you lived? ), or current circumstance (e.g., What is your place of employment? ). The best queries have answers that are not widely known and cannot easily become known to an attacker attempting to impersonate someone. 5 Thus, good 3 In contrast, DNA provide an independently verifiable proof of a highly probable biological connection to a person or of a genetic relationship between two people, because new DNA samples can be collected and checked whenever confirmation of the claim is sought. 4 A birth certificate is needed to obtain a U.S. passport, so these documents are not independent and there is little basis for increased confidence from having both. 5 There is, for example, little benefit in asking violinist Nadja Solerno-Sonnenberg about her mother s maiden name, which would likely be Solerno given the hyphenated construction of Solerno-Sonnenberg. And should the correct answer to a knowledge-based authentication query for a given individual become known to an attacker, it suffices to invent new queries and use them. However, such newer queries might be increasingly obscure, ultimately imposing an unacceptable memory burden on a subject, who must remember those answers.
4 40 Chapter 5. Authentication for People queries become difficult to find when there is a wealth of publicly available information about individuals. And the trends here are not favorable, with the ever-expanding world wide web and with cultural norms that encourage details of individuals lives to be revealed in blogs and through participation in online communities. With so much personal information available online, web search engines place at an attacker s fingertips the answers to lots of the queries that knowledge-based authentication systems have tended to use. Any knowledge-based authentication scheme must have access to correct answers for queries it poses. This leads to a vulnerabilitioes whenever different systems happen to employ intersecting sets of queries: One system can now impersonate its users to other systems, and furthermore an attacker who compromises one system can impersonate that system s users to other systems. In addition, people worried about having personal information aggregated may object in principle to storing so much information about them on a single system, although the information presumably would be stored in some secure way. In summary, knowledge-based authentication is convenient, since it imposes little burden on individuals to remember things, carry things, or submit their bodies to measurement. Moreover, we can increase our confidence in an authentication by requiring multiple queries to be correctly answered. But security of this scheme ultimately depends on attackers not having access to information about subjects, which is an assumption that is hard to check and might not be sound, rendering the approach unsuitable for high-confidence authentication. Nevertheless, we see it employed today, for example, in web sites where a user having forgotten his password responds to knowledge-based authentication queries to establish an identity; the web site then sends 6 containing a password to an address that is part of that identity. Secret-Based Authentication. An individual can be authenticated on the basis of a secret he knows, provided that secret is not known to would-be impersonators and is difficult to guess or steal. We simply check whether a person being authenticated as some identity knows the unique secret associated with that identity. Ideally, the secret is some string selected from a relatively large space of possibilities and in a manner unprejudiced by knowledge of reality or beliefs, since this makes guessing difficult. 7 Embodiments of such secrets include personal identification numbers (PINs), which are typically 4 digits long; passwords, which are likely at least twice as long and involve any characters; and passphrases, which are significantly longer still and also involve any characters. We use the term password in this chapter, but what is said applies to PINs, passphrases, and the other forms of secrets used for authenticating humans. Secret-based authentication can be surprisingly subtle to implement. People have difficulty memorizing seemingly random strings. And the ever increas- 6 This is typically not encrypted. Thus, the password would be available to any passive wiretapper, rendering the approach unsuitable for senstive applications. 7 The answers to knowledge-based authentication queries thus have only a superficial resemblence to such secrets, because the answers are prejudiced by knowledge of reality or beliefs and therefore the answers can be guessed by attackers.
5 5.1. Something You Know 41 ing power of computers means automated password guessing becomes feasible sooner than you would think. These impact how passwords are best stored, which in turn constrains the methods that can be used for checking whether a correct password has been provided Choosing a Password One obvious way to generate a password is to choose a string randomly from some large space of possible choices. Given a set comprising N characters, there are a total of N L length L strings of characters. For example, with the 52 lower- and uppercase alphabetic characters plus the 10 digits found on a computer keyboard, the set of strings comprising 8 characters contains ( ) 8 or equivalently 218,340,105,584,896 (approximately ) elements. Include punctuation symbols and blank spaces, which increasingly are being permitted in passwords, and the number of password candidates grows still larger. A password can be generated by a computer, invented by the person it will be used to identify, or furnished by the system operator. None of these approaches is a panacea. People are notoriously bad at memorizing random strings, and passwords generated by a computer will seem random. 8 So computer-generated passwords are hard to memorize, hence likely to be written down. A password that is written down can be seen by others and stolen. Passwords invented by people are usually devised to be easy to remember a word in the dictionary, a loved-one s name, a telephone number, a keyboard pattern (e.g., asdf ), or some combination thereof. Passwords drawn from such a significantly smaller space are known as a weak passwords because they are considerably easier to guess. 9 A password furnished by a system operator must be either computergenerated or selected by some person; one of previous two cases then applies. Moreover, an operator-selected password is best changed immediately by the recipient, to prevent the operator from subsequently abusing knowledge of that password. One of the above cases would apply to that new password, too. 8 Some have suggested that the computer employ rules to produce passwords that are easy to remember because they are pronounceable. For example, every consonant might be followed by a vowel and two adjacent letters might never both be vowels or consonants. Or, the computer might generate passwords that are random sequences of existing words. However, imposing such restrictions is counterproductive, since the amount of work to enumerate the space of possible password choices is now reduced, making that attacker s job easier. 9 The 20 volume Oxford English Dictionary (second edition) contains on the order of words. Compare that with the 146,813,779,479,510 (approximately ) strings having 10 or fewer alphabetic characters, and it becomes clear that there are considerably more random alphabetic strings than dictionary words.
6 42 Chapter 5. Authentication for People For reasons of convenince, most systems allow people to invent their own passwords. Additional means must then be used to defend against attackers guessing those weak passwords. In on-line guessing attacks, the system itself is used by the attacker to check password guesses. One defense here is to limit the rate or number of password guesses allowed, thereby reducing the chances that an attacker will make a correct guess. Make authentication a time-consuming process by requiring that passwords be entered manually, that checking a password require an intrinically long computation, and/or that the system s password checking routine include a sleep operation or some other delay. Impose a limit on unsuccessful guesses and, when that limit is reached, disconnect from the source and refuse later attempts to authenticate that identity (until a system operator intercedes). The second measure also increases the chances an attack will be detected while it is in progress or soon thereafter. Note, however, that limiting the number of unsuccessful password guesses for a given identity creates an opportunity for denial of service attacks; an attacker whose incorrect password guesses exceed the limit blocks all authentications for that identity, which prevents the bona fide owner of that identity from accessing the system. By restricting what information is returned when an authentication attempt fails, we further impede on-line guessing. Some systems prompt for the identifier being authenticated and reply with an error indicating if it is not known to the system. Such replies tell attackers what identifiers could serve as targets of attack. A better design is for the system to request the identifier and corresponding password together; only after receiving both, does the system reply. And if either the identifier is unknown or the password is erroneous then a single, minimally-informative response is returned (e.g., Authentication attempt failed. ). Covert channels provide another way an attacker might determine an identifier is valid. For example, if a system does not check the password when the identifier is invalid, then a longer elapsed time for processing an authentication request indicates when it is worth trying other password guesses for that same identifier. This vulnerability is eliminated by adding execution delays to create either uniform or random response times. Another example of a covert channel appeared in the TENEX operating system, where a password was a required argument to the connect system call. The implementation compared the password argument, character by character, with the correct password; it terminated when the first erroneous password character was found. If the password argument spanned a page boundary then a page fault occurred whenever the argument s characters appearing on the first page were a prefix of the password. Because the occurrence of a page fault could be sensed by the attacker and the attacker could control the alignment of a password argument on a page, a covert
7 5.1. Something You Know 43 channel enabled an N character password to be deduced in 26N guesses instead of the presumed 26 N guesses. 10 A system s response to a successful authentication attempt should give (i) the times when the last successful authentication for this identifier occurred, and (ii) the times when authentication was unsuccessfully attempted since. In reporting the last successful authentication, a user (who presumably will recall when he last authenticated that identifier) can detect a prior successful online guessing attack; in reporting past unsuccessful authentications, the user becomes aware that on-line guessing attacks had been attempted. The strongest defense against attackers guessing weak passwords is to enforce a prohibition against users choosing them. To implement this, rules such as those in Figure 5.1 can be employed to prevent users from creating easily guessed passwords. Some of the rules are obvious (e.g., avoid passwords that appear in a dictionary); other rules correspond to memory tricks that people use and attackers know people use (e.g., replacing a letter by a number that looks similar, such as replacing e in by 3 or l by 1 ). No set of syntactic rules, however, will completely characterize easy-to-guess passwords, and user laziness about memorization provides a strong incentive for discovering classes of passwords that are easy to remember but the rules do not reject. Sooner or later, attackers too discover these password classes and include such passwords in their on-line guessing attacks Storing Passwords The obvious scheme for storing passwords is to use a file that contains the set of pairs uid i, pass i, where uid i is an identifier and pass i is the associated password. The file system s authorization mechanism is then used to restrict which principals can access this password file, as follows. An ordinary user must not be able to read the password file or its backups. This prevents that user from obtaining the password for any identifier. An ordinary user must not be able to write the password file or its backups. This prevents that user from changing the password for an identifier (to then know that password). The program that authenticates users must be able to read the password file. The program used to add/remove user identifiers and change passwords must be able to read and write the password file. 10 The first character of the password argument is placed as the last character of a page, and connect is invoked. In at most 26 tries, the correct first character will be identified because a page fault occurs. The password argument is next aligned so the first two characters appear as the last characters of a page; another 26 guesses suffice to find that prefix. After N steps, each requiring at most 26 guesses, the length N password is known.
8 44 Chapter 5. Authentication for People 1. Strings easily derived from words or sequences of words appearing in an English or foreign language dictionary, because they appear verbatim or reversed, perhaps with the following transformations applied: (a) deleting vowels or spaces, (b) capitalizing some letters, (c) adding a suffix and/or prefix, (d) replacing one or more letters by similar looking non-alphabetic characters (e.g., 0 for o ) and/or by homophonic letters or clauses (e.g., 4 for for ). 2. Strings derived (in the sense of 1) from the user s identity name, initials, login id, or other attributes. 3. Strings derived (in the sense of 1) from acronyms, names of people, or names of places. 4. Strings shorter than a certain length (e.g., 8 characters). 5. Strings that do not contain a mix of numbers, special symbols, upper- and lowercase characters. 6. Strings produced by typing simple patterns on the keyboard. 7. Strings comprising only numbers. 8. Strings that mix numbers and characters but resemble license plates, office numbers, etc. Figure 5.1: Rules Characterizing Weak Passwords Security here requires trusting that the file system authorization mechanism has no vulnerabilities, that the access-authorization policy for the password file is correctly set whenever that file is edited and stored, that programs authorized to read the file do not leak its contents, and that traces of file contents are not left to be read from unallocated memory or unallocated disk pages that previously stored the password file. Some are troubled by the need for all this trust, but if the trust is not misplaced then storing passwords in this way leaves only one avenue to attackers: on-line guessing. An alternative to using the file system s authorization mechanism for protecting the confidentiality of passwords is to compute a cryptographic hash function H(pass i ) for each each password pass i and store the set of pairs uid i, H(pass i ) as the password file. Because by assumption H( ) is a one-way function, knowledge of H(pass i ) will not reveal enough about pass i to be useful attackers. Letting HashPwd denote the set of uid i, H(pass i ) pairs stored in the password file, a person P is deemed to be authenticated if and only if P en-
9 5.1. Something You Know P Sys: uid, pass 2. Sys: if uid, H(pass) HashPwd then P deemed authenticated. Figure 5.2: Hashed Password Authentication Protocol ters some identifier uid and password pass, and the system determines that uid, H(pass) HashPwd holds. This depicted in Figure 5.2. Historically, MD5 or SHA-1 were used for H( ), but cryptoanalyists established in 2005 that MD5 or SHA-1 do not satisfy the collision resistance properties required of cryptographic hash function. Some other cryptographic hash function should therefore be used. An alternative, albeit slower, is to use a shared key encryption algorithm configured to encrypt some constant C, using pass (or something derived from it) as the key; early versions of UNIX implemented H( ) by iterating DES several times with 0 for C. Recall, though, that faster is not necessarily better when it comes to validating a password on-line guessing attacks are hindered by slower password checking, because then fewer guesses can be attempted in a given interval. Salt. Unrestricted read access to hased password file HashPwd still enables off-line guessing attacks, also known as dictionary attacks. The attacker first obtains a list 11 of candidate passwords or, using rules like those in Figure 5.1, constructs such a list; this list is then used by the attacker in computing a dictionary, which is a set Dict of pairs w, H(w) for each word w in the list of candidate passwords. Finally, the attacker reads HashPwd from the system to be attacked and generates the set of pairs { uid, pass uid, H(pass) HashPwd pass, H(pass) Dict} (5.1) by identifying elements having the same H(pass) value in both HashPwd and Dict. Each uid, pass pair in (5.1) enables the attacker to impersonate identifier uid. The computation of Dict and (5.1) constitute an up-front cost to the attacker. However, such an investment often can be justified. The work to compute Dict is amortized, because the single Dict suffices for attacking every system whose password file is computed using cryptographic hash function H( ). All instances of a given operating system typically use the same hash function, and therefore a single Dict can be used in attacking any target running that operating system. Beyond obtaining a copy of HashPwd, the computation involved in actually attacking a given system the construction of (5.1) need not be performed on that target system. The chance that an attacker s preparations will be discovered, hence the risk to the attacker, is thus reduced. 11 In 2007, lists found on attacker web sites contained as many as 40 million entries.
10 46 Chapter 5. Authentication for People 1. P Sys: uid, pass 2. Sys: uid, n, p := HashSaltPwd[uid] 3. Sys: if H(pass n) = p then P deemed authenticated. Figure 5.3: Hashed Password Authentication Protocol with Salt Moreover, the attacker is now not limited by a target system s computational power or deliberately slow implementation of H( ). The attack is likely to yield multiple user identifiers with passwords for the target system, so it provides the attacker with multiple avenues of compromise. This is ideal for the attacker who does not need to impersonate a specific user, and many attacks require only the initial access that impersonating any user provides. So the offline guessing attack succeeds if any user identifier has a weak password. One defense against off-line guessing attacks is to change the password file in a way that makes the computation of (5.1) infeasible. To accomplish this, we might store with each uid i a nonce n i, called salt, and combine that nonce with pass i before computing cryptographic hash function H( ). The password file now stores a set HashSaltPwd of triples, uid i, n i, H(pass i n i ). Early versions of Unix used 12-bit numbers for salt; the nonce for a given uid was obtained by reading the real-time system clock when creating the account for uid. We extend the protocol of Figure 5.2 as shown in Figure 5.3 to accommodate the per uid salt, where HashSaltPwd[uid] denotes the unique triple having the form uid,... in HashSaltPwd. With b bit nonces for salt, off-line guessing requires the attacker to compute in place of Dict the considerably larger set SaltDict of triples w, n, H(w n) for each candidate password w and each value n satisfying 0 n 2 b 1. So SaltDict is 2 b times as large as Dict and thus considerably more expensive to compute and store. Analogous to (5.1), the attacker now constructs the set of pairs { uid, pass uid, n, H(pass n) HashSaltPwd (5.2) pass, n, H(pass n) SaltDict} and element uid, pass in that set enables the attacker to impersonate corresponding user uid. Pepper. The cleartext salt in HashSaltPwd does not defend against what we will call a limited off-line guessing attack, where one particular system is the target. The attacker here needs to compute only a subset of SaltDict the subset containing only those triples w, n, H(w n) for which salt n appears in HashSaltPwd on the target system. If HashSaltPwd contains N elements then this subset of SaltDict is only N times the size of Dict. For b bits for salt, N 2 b is likely to hold, so the attacker replaces an expensive computation
11 5.1. Something You Know P Sys: uid, pass 2. Sys: if ( n : uid, H(pass n) HashPepperPwd ) then P deemed authenticated. Figure 5.4: Hashed Password Authentication Protocol with Pepper with one that is considerably cheaper. Specifically, the attacker incurs a cost proportional to N Dict for computing a SaltDict that works against the one target system of interest, instead of incurring a cost proportional to 2 b Dict for the SaltDict that would work against all targets. To defend against limited off-line guessing attacks, we might keep the salt secret by storing a set HashPepperPwd of pairs uid i, H(pass i n i ), where nonce n i, now called the pepper, is not stored elsewhere in the tuple for uid i (as salt would be). A protocol for authenticating uid given a password pass is given in Figure 5.4; step 2 deems P authenticated if and only if there is some pepper n for which uid, H(pass n) is an element of HashPepperPwd. To determine whether such an n exists, the system must enumerate and check possible values. This search is best started each time at a different, randomly selected place in some standard enumeration of possible pepper values; otherwise, the delay to authenticate uid conveys information about whether n is early or late in that standard enumeration of possible pepper values, thereby reducing the size of the search space, hence the work required of an attacker. When pepper is used, the amount of work required to build a dictionary PepperDict for an off-line guessing attack is proportional to the number of pairs w, H(w n), for w ranging over the candidate passwords and n ranging over all possible pepper values. For b bits of pepper, this means that PepperDict is a factor of 2 b larger than Dict; the attacker s work has been increased exponentially. Moreover, unlike salt, pepper defends against limited off-line guessing attacks, because the absence of cleartext pepper in HashPepperPwd means an attacker has no way to generate the target-specific smaller dictionary that enables a limited off-line guessing attack. So b bits of pepper constitutes a better defense than b bits of salt. Pepper is not a panacea, though. The number of possible pepper values affects the time required to perform step 2 of the authentication protocol in Figure 5.4. If this delay is too large, then users will lose patience. So the number of bits of pepper must be kept small enough for step 2 to complete within a few seconds, and the potency of pepper as a defense is limited. Compare this to salt. The number of possible salt values is virtually unbounded, being constrained only by the storage required for HashSaltPwd. Putting it Together. By combining salt and pepper, we obtain a better defense than results when either is used alone. Salt salt i and pepper ppr i are both inputs to the cryptographic hash computed for each password pass i ; passwords are stored in a set HashSsndPwd of triples uid i, salt i, H(pass i salt i ppr i ) ; and the protocol of Figure 5.5 is used for authentication.
12 48 Chapter 5. Authentication for People 1. P Sys: uid, pass 2. Sys: uid, s := HashSpicedPwd [uid] 3. Sys: if ( ppr : uid, s, H(pass s ppr) HashPepperPwd ) then P deemed authenticated. Figure 5.5: Hashed Password Authentication Protocol with Salt and Pepper If there are bs bits of salt, bp bits of pepper, and N tuples in HashSsndPwd, then a dictionary SsndDict for an off-line guessing attack would be 2 bs+bp times larger than Dict, and the subset of SsndDict required for a limited off-line guessing attack would be 2 bp N times larger than Dict. Off-line attacks are made infeasible by choosing bs large enough. Defense against limited off-line guessing attacks, however, depends on the number (2 bp ) of possible pepper values which, unfortunately, is limited by the processing speed of the target machine and the delay that users are willing to tolerate for step 3 of Figure 5.5. Even stronger security requires some form of defense in depth, such as using file system authorization to restrict read access to a password file that stores cleartext salt or any form (i.e., hashed, salted and/or peppered) of password Authenticating Requests for Passwords A program that requests your password might be running on behalf of an operating system that is trying to authenticate you. Or, it might be a password harvester masquerading as the operating system and running on behalf of an attacker who is attempting to steal your password. Human users thus need some means to authenticate the source of password requests, and that is the subject of this section. We shall see that because humans and computers have such different capabilities, the means by which humans can authenticate computers are very different from means computers can employ to authenticate humans. Trusted Path. A trusted path is a trustworthy communications channel between an I/O device, like a keyboard and display, and a known program, like an operating system s authentication routine. One way users can avoid being spoofed by password requests from an attacker s program is to open 13 such a trusted path and communicate using it. The components and protocol steps are given in Figure 5.6. The security of this scheme depends on trusting the keyboard driver and OS authentication routine. An attacker who alters either can build a password harvester that, to a human user, appears to behave like what is outlined in 12 For example, the shadow password file /etc/shadow in LINUX and /etc/master.passwd in BSD Unix systems are read protected, and they store cleartext salt along with hashed, salted passwords. Both systems continue to support /etc/passwd, which is generally readable but does not contain any form of the password for each user id. 13 In Microsoft s Windows NT operating system and its successors, for example, typing Ctrl-Alt-Delete serves this purpose.
13 5.1. Something You Know User: Activate the secure attention key (SAK) at the keyboard. 2. OS keyboard driver: Intercept each SAK activation and start the OS authentication routine. Display a password request prompt (perhaps in a separate window). Then monitor the keyboard for the user s response. 3. User: Enter a user id and corresponding password. 4. OS keyboard driver: Forward that user id and password to the OS authentication routine. 5. OS authentication routine: Validate the user id and password. Figure 5.6: Trusted Path Component Authentication Protocol Figure 5.6. You might think that rebooting the computer from its disk would defend against such a compromised keyboard driver or OS authentication routine. However, rebooting from disk does not defend against an attacker who has corrupted the version of the operating system stored on the disk. Nor does rebooting from some other (known to be clean) I/O device suffice, if the attacker has modified the boot loader to read the corrupted boot image on disk no matter what boot device is specified. Defend the boot loader and an attacker can force the wrong boot loader to execute by exploiting BIOS vulnerabilities; defend the BIOS, and an attacker s ability to modify the hardware remains problematic. What then is the benefit of providing support for a trusted path? First, physically limiting access to the hardware does prevent an attacker from modifying it, so one class of attacks can be ruled out. Second, if we trust the hardware, thus assume it cannot be compromised, then we can defend against the other attacks outlined above by leveraging a secure co-processor to detect modification or replacement of system software. 14 Finally, repositioning a vulnerability from a higher layer (e.g., the operating system) down to a lower layer (e.g., the BIOS) typically increases the security of the system, because exploiting vulnerabilities at lower system layers usually requires more sophistication hence exceeds the expertise of some threats. Visual Secrets. Visual appearance is another way that users can authenticate the source of password requests. Here, the manner in which the request is rendered serves as a visual secret that is shared between requester and responder. The secret might be a formatting convention, some specific text, and/or an image; or the secret might embody how to access routines that provide the only way for controlling some discernable aspect of certain outputs. An executing program demonstrates knowledge of the visual secret by how or where the password request is rendered. The human responder validates the password request by inspecting it and ignoring those password requests whose 14 This is discussed in??.
14 50 Chapter 5. Authentication for People appearance departs from what is expected. An attacker s password request can now succeed only by demonstrating knowledge of the appropriate visual secret. That can be made difficult in two ways. Share a different visual secret with each user. Here, the protocol for a password request involves two separate steps: (i) request a user id, and (ii) request the password for that user id by displaying the appropriate shared visual secret for the given user id. 15 An attacker succeeds only by obtaining the visual secret for each user id to be spoofed, something presumed to be just as difficult as obtaining the corresponding password by means other than a spoofed request. Prevent arbitrary programs from rendering certain text or images in certain regions of a display. By including in a password request some content that can be rendered only by a program demonstrating knowledge of a secret, we prevent an attacker s program from generating a legitimate password request. These schemes work when humans can and do distinguish among various possible renderings of password requests. Yet humans have a tendency to overlook minor details when reading text or viewing images. That enables attacks. For instance, most people will not differentiate between characters output by a program and an embedded image containing those same characters. Thus, by embedding images instead of outputting characters, a program might be able to circumvent defenses where knowledge of the secret is being demonstrated by printing a character sequence. Experience with web browsers shows that people also don t look at status fields much less look at them carefully to see whether they display expected values. A tamper-proof status field for the name of a requester is, therefore, unlikely to defend against bogus requesters whose names are spelled similarly to bona fide requesters. Our human insensitivity to slight differences in rendering helps enable phishing attacks, where attackers attempt to acquire private information by directing users to a web site designed to resemble the web site for some legitimate institution. Users are induced to visit the attacker s web site by being presented with a link that closely resembles a link for the site being spoofed 16 (e.g., versus they are not careful about checking this, and they enter private information (a password, perhaps) which then becomes known to the attacker. Humans are quite good at recognizing and distinguishing pictures of different scenes or people. Thus, certain per-user visual secrets those involving larger, richer images seem promising as a means for a human to authenticate request sources. Moreover, improvements in user interfaces in conjunction with 15 To prevent attackers from determining whether a particular user id is valid, the system must not behave differently in step (ii) when a unknown user id is entered in step (i). One solution is for the system to create a new visual secret for that invalid user id. 16 This is sometimes known as a cousin-name attack.
15 5.1. Something You Know 51 an expanding population of more-experienced users ought to mean that, in the future, users will be better at detecting differences in how requests are rendered Password Pragmatics A single password is far easier to devise and remember than multiple passwords. So it is tempting to stick with one password, reusing it for all your various different identities (e.g., computer accounts on different machines, various web sites, etc.). However, an attacker now gains great leverage from compromising that single password. There are two obvious defenses: If each password has only a limited lifetime, then a compromised password sooner or later will become useless to an attacker even if that compromise never becomes known. If separate passwords are employed for different identities, then an attacker who compromises one password could impersonate only the one identity. How might systems support these practices? Password Expiration. Some systems periodically force users to select new passwords, either after a fixed interval has elapsed (typically, months) or after the password has been used some specified number of times. By storing a user s expired passwords, the system can prevent new passwords from resembling their predecessors. 17 Note the trade-off between security and convenience. Passwords that must be changed frequently are better for security, but frequent memorization of new passwords is inconvenient. Moreover, if users finds all this memorization too burdensome and write-down their current password then they undermine security by facilitating password theft. Infrequent users pose a special problem for password expiration schemes. The infrequent user might well resent having to access the system periodically solely for the purpose of replacing a password before it expires. Yet to allow authentication using an expired password even if the authenticated user must immediately select a new password is risky, because an attacker who has compromised an old password would now get to pick the new password, thereby circumventing the defense password expiration was intended to provide. Password Hashes. An individual can, with a minimum of effort, create a distinct password pass I for each identity I by (i) memorizing a single secret s and (ii) using a function F( ) to combine s and I and derive password 17 However, this functionality can be circumvented by resourceful users. For example, if passwords expire every month, then passwords Mycroft01, Mycroft02,..., Mycroft12, are easy for a user to generate once Mycroft has been memorized, and a system might deem each of these different enough from its predecessor. Unfortunately, passwords forming a sequence that is easy for a user to generate are probably also easy for an attacker to reconstruct from a single compromised password in the sequence. An attacker who successfully compromises Mycroft02 in February, for instance, would be wise to try Mycroft05 in May.
16 52 Chapter 5. Authentication for People pass I = F(s, I). You might, for example, select Moriarty as your secret, memorize it, and then (as needed) produce password MwowrwieaBratyycom for your identity at MwowrwiCaNrNtcyom for and so on. 18 However, as noted above, such schemes risk producing weak passwords if a single compromised password provides enough information about both secret s and combining function F( ) so that an attacker can deduce passwords associated with other identities. Were F( ) one-way, then even if F( ) were publicly known, an attacker who compromises one or more passwords would learn nothing useful about the secret input s to F( ) used to produced those passwords. The attacker would thus be no better off for deducing passwords for other identities. Cryptographic hash functions are one-way. Thus, given a cryptographic hash function H( ), a strong password for each of a principal s identities can be obtained if the principal memorizes a single secret s and uses password hash H(s I) as the password for identity I. In particular, the preimage resistance of H( ) would make it infeasible for an attacker to calculate s I, hence learn s, from knowledge of password H(s I). Few humans will be able to calculate H(s I) mentally, nor would very many be willing to undertake a paper and pencil calculation in order to be authenticated each time. This restricts the applicability of password hashes to settings where a computer is available to aid in generating passwords: The human principal inputs the secret s along with the identity I for which a password is sought; the computer provides the sought password by evaluating H(s I) and then erasing s and H(s I) from its memory (so that later attacks on the computer can reveal neither). Password hashes are the basis of PwdHash, a web browser plug-in to enable users who memorize only a single secret to authenticate themselves using a different password at each different web site. Password fields in web page forms are usually delimited by a special HTML tag. This tag allows the PwdHash plug-in to replace any text pass a user enters into such a password field with H(pass url), where url is the url of the web page being visited. The information sent back to the web site thus contains a site-specific password H(pass url), even though the human user has not memorized or entered any site-specific passwords. Moreover, such automatic generation of site-specific passwords defends against certain kinds of phishing attacks. This is because the phishing web site and the site being impersonated will have different url s. Therefore, the password sent to the phishing web site will be different from the password that would have been sent to the site being impersonated phishing sites thus cannot learn passwords that can be used to impersonate a user on other sites. Password Hygiene. To focus only on system mechanisms for preventing password compromise ignores a significant vulnerability: human users who might reveal their passwords through action or inaction. The defense against such attacks is twofold: user education about easily exploited behaviors and the 18 Here, function F(s, I) interleaves its arguments s and I.
17 5.1. Something You Know 53 adoption of practices to discourage that behavior. Both are covered in what follows. Sharing Passwords. The human penchant for being helpful can sometimes become a vulnerability. A common attacker s ploy is to telephone a user and pretend to be a system operator needing that user s password in order to fix an urgent problem. The user, who like most people wants to be helpful, reveals his password. In a variant, the attacker calls a system operator, pretending to be a bona fide user with an urgent need to access the system but has forgotten his password. The operator, trying to be helpful, resets that user s password and informs the attacker of the new password. Neither of these attacks could succeed if system designs never required one user to reveal his password to another and, therefore, users could know never to reveal their passwords to anyone. Some users who share their passwords with others are simply confused about the difference between authorization and authentication. We all have occasion to leave our house keys with people we trust, so they can take in the mail or feed Mena the cat. The lock on the front door is an authorization mechanism; it grants access to those who possess our house key. So a password, because it unlocks access to a computer, is equated (erroneously) with a house key; sharing the password is then presumed (erroneously) to be a way others can be granted computer access. In fact, a computer s login authorization mechanism grants computer access to users having certain identities, and sharing your password is tantamount to granting your identity to somebody else. The real problem is user ignorance. Recording Passwords. Few people are able to memorize even a modest number of strong passwords. The rest of us choose between two options: 1. reuse a few strong passwords (because memorizing those is a manageable prospect) rather than having a separate password for each identity, or 2. record passwords in some written or electronic form, so there is no need to memorize them. Each option brings vulnerabilities that enable a password-based authentication to be compromised. Option 1 sacrifices a form of defense in depth. When the same password is used for multiple identities, then after compromising the password for one identity, an attacker can be authenticated under the other identities as well. If different identities have access to different resources, then this undermines the Principle of Least Privilege. Yet there are contexts where having the same password for multiple identities is perfectly reasonable notably, situations where having multiple, distinct identities was not the user s choice. For example, many newspapers and other web-based information providers create a distinct identity for every user they serve, and these sites typically employ password authentication; no harm is done if a user who would have been satisfied with having a
18 54 Chapter 5. Authentication for People single identity to access some set of sites chooses the same password for all of them. With option 2, our concern should be defending against attackers accessing the recorded password list. One classic example is the handwritten note so often found affixed to a system console in a computer room, giving passwords for system operator accounts. Anyone who gains entry to that computer room (say, by convincing the janitor to unlock the door) can use these passwords to become a system operator. Another example is the printed list of passwords that is carefully locked away until it is discarded (without first being shredded), so the list becomes available to any attacker willing to rummage through the trash. 19 Defense in depth suggests that both encryption and physical means (i.e., physical lock and key) be used to protect recorded password lists. Observing Passwords. Even a password that has not been written down is potentially vulnerable to theft by attackers who can observe or monitor emanations from a system. Some of these attacks are straightforward; others require considerable expertise in signal-processing. An attacker might peer over the user s shoulder and watch the password being typed or might use a telescope to watch from a distance. This is known as shoulder surfing. The obvious defense is to shield from view the keyboard being used to enter a password. Keyboards on ATMs, for example, are often positioned so they cannot be seen by others when somebody is using the ATM. Instead of watching the keyboard, an attacker might instead observe the system s display as a password is typed. Direct visual observation is not required. Researchers have been able to recover the contents of a CRT display by monitoring the diffuse reflections from walls, and they have been able to recover the contents of an LCD display by monitoring RF radiation from the video cable connecting the LCD to the computer. Here, the obvious defense is not to echo the typed characters on the display when a password is entered. Each key on a keyboard will have a slightly different sound when pressed, and programs exist to perform the signal processing needed recover a user s keyboard inputs from recordings of such acoustic emanations. Background noise (or music) is easily filtered out, so it is not an effective defense. Physical security to prevent an adversary from planting a microphone or other listening device seems to be the best defense against such attacks. 19 The practice of combing through commercial or residential trash in search of confidential information is referred to as dumpster diving.
19 5.2. Something You Have Something You Have An artifact can be used for authenticating someone if it cannot be counterfeited by threats of concern. Give an authentication token A P to a person having identity P (but to nobody else) and, thereafter, anyone able to prove possession of A P can be authenticated as having identity P. Something you have speaks for you and, therefore, can be used to authenticate you. This does mean that an attacker who steals A P is able to impersonate P. And arguably, it is easier to steal an artifact than to steal a secret (which is materialized only when it is being input). Theft of a secret, however, might not be noticed, whereas P is likely to notice if A P is missing; and once the theft is noticed, P can foil would-be impersonators by informing a system administrator that A P no longer speaks for P. We defend against attackers using stolen authentication tokens by employing multi-factor authentication. Typically, knowledge of a PIN and possession of the authentication token are both required, yielding 2-factor authentication. In some systems, users choose two secrets a normal PIN and a duress PIN. Entering the duress PIN instead of the normal PIN causes authentication to proceed but (i) alerts system operators that an attacker is forcing the user to authenticate, and (ii) authenticates the user to a version of the system that gives the appearance of operating on real data but really isn t, rendering ineffectual attacker-coerced operations that follow. Authentication tokens (also known as security tokens, hardware tokens, or cryptographic tokens) come in various shapes and sizes, including printed pages of values, plastic credit cards with magnetic stripes, radio-frequency identification (RFID) chips, fobs containing small LCD displays, dongles with USB connectors, and calculator-like devices having keypads and displays. What all of these have in common is the ability to store a value; this value is associated with the identity the token authenticates. How this value is sensed by a computer doing authentication depends on the token s physical form. Sometimes special hardware is required: authentication tokens having magnetic stripes must be swiped through a special reader, and RFID chips are interrogated using a radio transceiver tuned to the appropriate frequency. But for other types of authentication tokens, special hardware is not needed. Authentication tokens having LCD readouts, for example, can display a value which a user reads and then conveys to the authenticating computer using that computer s keyboard; dongles that plug into USB connectors become I/O devices the computer s operating system reads directly. The value an authentication token stores might well exceed what a human can reasonably be expected to memorize. The authentication token, in effect, augments the human s memory. Some types of authentication tokens go even further in compensating for human limitations. An authentication token might perform cryptographic operations, thereby enabling cryptography to be used for authenticating the token holder, and it might read and store information from the computer to which it connects, so the the problem of a computer authenticating a person is now transformed into the problem of one computer
20 56 Chapter 5. Authentication for People authenticating another. Authentication tokens employing digital circuits require electric power. Batteries are an obvious power source, but they are relatively large and, because they have finite lifetimes, must be replaced or recharged periodically. Alternatively, the channel that connects an authentication token to the computer authenticating it could provide power. Tokens with USB connectors can get power from the USB; so-called passive RFID tokens get their power from the radio signal that interrogates them. 20 Such intermittent power sources, however, cannot be used for digital circuits that require power to store values between authentications. Magnetic stripes can be used to store information, and they make no power demands on the authentication token. 21 But a disadvantage of magnetic stripes is their low storage density. The magnetic stripe on a typical credit card, for example, is able to store only a few hundred characters. Moreover, magnetic stripes cannot be used to perform calculations. The design of an authentication token invariably involves trade-offs. Understanding interactions among the various dimensions of the design space is thus instructive, whether you are selecting among existing authentication tokens or designing from scratch. Form Factor. Users are primarily interested in convenience. Smaller and lighter tokens are preferred. The way information is transferred between the token and the computer also influences convenience: radio is the most convenient, physical connections less so, and least convenient would be when users must manually transfer information by typing into the keyboard on one device what they see on another device s display. Finally, periodic maintenance operations, for example to load new secrets or deal with dead batteries, are seen as a burden. Computational Capabilities. System designers are concerned with what computations the token can perform and how it communicates. Stronger authentication methods require cryptographic operations. Also of interest is the channel between the authentication token and the authenticating computer: Is that channel secure against passive wiretappers? What about active wiretappers? Economics. Cost differences become significant when large numbers of authentication tokens need to be procured. However, less expensive tokens e.g., RFID chips and cards having magnetic stripes require more expensive, specialized hardware at the authenticating computers, so the ratio of authentication tokens to authenticating computers becomes relevant. Less expensive tokens typically are easier to counterfeit, creating a tension between cost and security. 20 Other active RFID tokens have batteries. 21 With magnetic stripe memory, power is required by the I/O device used to read and update the magnetic stripe. This I/O device is typically connected to and powered by the authenticating computer.
Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 10 Authentication and Account Management
Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 10 Authentication and Account Management Objectives Describe the three types of authentication credentials Explain what single sign-onMore information
CSC 474 -- Network Security. User Authentication Basics. Authentication and Identity. What is identity? Authentication: verify a user s identity
CSC 474 -- Network Security Topic 6.2 User Authentication CSC 474 Dr. Peng Ning 1 User Authentication Basics CSC 474 Dr. Peng Ning 2 Authentication and Identity What is identity? which characteristicsMore information
Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 7 Access Control Fundamentals
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 7 Access Control Fundamentals Objectives Define access control and list the four access control models Describe logical access controlMore information
Client Server Registration Protocol
Client Server Registration Protocol The Client-Server protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes areMore information
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467a: Cryptography and Computer Security Notes 1 (rev. 1) Professor M. J. Fischer September 3, 2008 1 Course Overview Lecture Notes 1 This course isMore information
Authentication. Computer Security. Authentication of People. High Quality Key. process of reliably verifying identity verification techniques
Computer Security process of reliably verifying identity verification techniques what you know (eg., passwords, crypto key) what you have (eg., keycards, embedded crypto) what you are (eg., biometric information)More information
Overview Most of the documentation out there on the transition from SHA-1 certificates to SHA-2 certificates will tell you three things:
SHA-1 Versus SHA-2 Overview Most of the documentation out there on the transition from SHA-1 certificates to SHA-2 certificates will tell you three things: - Breaking SHA-1 is not yet practical but willMore information
Two-Factor Authentication and Swivel
Two-Factor Authentication and Swivel Abstract This document looks at why the username and password are no longer sufficient for authentication and how the Swivel Secure authentication platform can provideMore information
Authentication Types. Password-based Authentication. Off-Line Password Guessing
Authentication Types Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4:More information
It may look like this all has to do with your password, but that s not the only factor to worry about.
Account Security One of the easiest ways to lose control of private information is to use poor safeguards on internet accounts like web-based email, online banking and social media (Facebook, Twitter).More information
Digital Signatures on iqmis User Access Request Form
Digital Signatures on iqmis User Access Request Form When a user clicks in the User Signature block on the iqmis Access Form, the following window appears: Click Save a Copy and rename it with your name,More information
Guidance on Multi-factor Authentication
Guidance on Multi-factor Authentication June 2006 Guidance on Multi-factor Authentication Guidance on Multi-factor Authentication State Services Commission June 2006 Version 1.0 ISBN 0-478-24466-5 CrownMore information
2.4: Authentication Authentication types Authentication schemes: RSA, Lamport s Hash Mutual Authentication Session Keys Trusted Intermediaries
Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the ApplicationMore information
White Paper: Multi-Factor Authentication Platform
White Paper: Multi-Factor Authentication Platform Version: 1.4 Updated: 29/10/13 Contents: About zero knowledge proof authentication protocols: 3 About Pairing-Based Cryptography (PBC) 4 Putting it allMore information
Server Security. Contents. Is Rumpus Secure? 2. Use Care When Creating User Accounts 2. Managing Passwords 3. Watch Out For Aliases 4
Contents Is Rumpus Secure? 2 Use Care When Creating User Accounts 2 Managing Passwords 3 Watch Out For Aliases 4 Deploy A Firewall 5 Minimize Running Applications And Processes 5 Manage Physical AccessMore information
Cryptographic Key Infrastructure
Cryptographic Key Infrastructure Goal: bind identity to key Classical: not possible as all keys are shared Use protocols to agree on a shared key (see earlier) Public key: bind identity to public key CrucialMore information
Advanced Authentication
White Paper Advanced Authentication Introduction In this paper: Introduction 1 User Authentication 2 Device Authentication 3 Message Authentication 4 Advanced Authentication 5 Advanced Authentication isMore information
Contents. Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008
Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008 Contents Authentication and Identity Assurance The Identity Assurance continuum Plain Password AuthenticationMore information
White Paper Preventing Man in the Middle Phishing Attacks with Multi-Factor Authentication
White Paper Preventing Man in the Middle Phishing Attacks with Multi-Factor Authentication Page 1 of 8 Introduction As businesses and consumers grow increasingly reliant on the Internet for conductingMore information
Authentication Tokens
State Capitol P.O. Box 2062 Albany, NY 12220-0062 www.its.ny.gov New York State Information Technology Standard IT Standard: Authentication Tokens No: NYS-S14-006 Updated: 05/15/2015 Issued By: NYS ITSMore information
CHOOSING THE RIGHT PORTABLE SECURITY DEVICE. A guideline to help your organization chose the Best Secure USB device
CHOOSING THE RIGHT PORTABLE SECURITY DEVICE A guideline to help your organization chose the Best Secure USB device Introduction USB devices are widely used and convenient because of their small size, hugeMore information
1.2 Using the GPG Gen key Command
Creating Your Personal Key Pair GPG uses public key cryptography for encrypting and signing messages. Public key cryptography involves your public key which is distributed to the public and is used toMore information
VeriSign Microsoft Office/Visual Basic for Applications (VBA) Code Signing Digital Certificates Realizing the Possibilities of Internet Software Distribution CONTENTS + What Is Developer Code Signing?More information
Tips for Banking Online Safely
If proper attention is given to safety and security, banking and monetary activities can be completed online in a convenient and effective fashion. This guide helps to establish procedures for remainingMore information
Casey State Bank Online Banking Agreement and Disclosure
Casey State Bank Online Banking Agreement and Disclosure Please carefully read this entire agreement and keep a copy for your records. By pressing the I ACCEPT button, you agree to the terms and conditionsMore information
How Drive Encryption Works
WHITE PAPER: HOW DRIVE ENCRYPTION WORKS........................................ How Drive Encryption Works Who should read this paper Security and IT administrators Content Introduction to Drive Encryption.........................................................................................More information
A Security Survey of Strong Authentication Technologies
A Security Survey of Strong Authentication Technologies WHITEPAPER Contents Introduction... 1 Authentication Methods... 2 Classes of Attacks on Authentication Mechanisms... 5 Security Analysis of AuthenticationMore information
Biometrics in Physical Access Control Issues, Status and Trends White Paper
Biometrics in Physical Access Control Issues, Status and Trends White Paper Authored and Presented by: Bill Spence, Recognition Systems, Inc. SIA Biometrics Industry Group Vice-Chair & SIA Biometrics IndustryMore information
Designing a Secure Client-Server System Master of Science Thesis in the Programme Software Engineering & Technology
Designing a Secure Client-Server System Master of Science Thesis in the Programme Software Engineering & Technology FREDRIK ANDERSSON Department of Computer Science and Engineering CHALMERS UNIVERSITYMore information
Two Factor Zero Knowledge Proof Authentication System
Two Factor Zero Knowledge Proof Authentication System Quan Nguyen Mikhail Rudoy Arjun Srinivasan 6.857 Spring 2014 Project Abstract It is often necessary to log onto a website or other system from an untrustedMore information
Computer Security and Privacy
Computer Security and Privacy 5-2 Protecting Your Computer Lesson Contents Protecting Your Computer Guidelines for Protecting Your Computer Best Practices for Securing Online and Network Transactions MeasuresMore information
Full Compliance Contents
Full Compliance for and EU Annex 11 With the regulation support of Contents 1. Introduction 2 2. The regulations 2 3. FDA 3 Subpart B Electronic records 3 Subpart C Electronic Signatures 9 4. EU GMP AnnexMore information
Aegis Padlock for business
Aegis Padlock for business Problem: Securing private information is critical for individuals and mandatory for business. Mobile users need to protect their personal information from identity theft. BusinessesMore information
SENSE Security overview 2014
SENSE Security overview 2014 Abstract... 3 Overview... 4 Installation... 6 Device Control... 7 Enrolment Process... 8 Authentication... 9 Network Protection... 12 Local Storage... 13 Conclusion... 15 2More information
Cryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 9: Authentication protocols, digital signatures Ion Petre Department of IT, Åbo Akademi University 1 Overview ofMore information
ScoMIS Encryption Service
Introduction This guide explains how to install the ScoMIS Encryption Service Software onto a laptop computer. There are three stages to the installation which should be completed in order. The installationMore information
Frequently Asked Questions (FAQ)
Your personal information and account security is important to us. This product employs a Secure Sign On process that includes layers of protection at time of product log in to mitigate risk, and thwartMore information
Multi-factor authentication
CYBER SECURITY OPERATIONS CENTRE (UPDATED) 201 (U) LEGAL NOTICE: THIS PUBLICATION HAS BEEN PRODUCED BY THE DEFENCE SIGNALS DIRECTORATE (DSD), ALSO KNOWN AS THE AUSTRALIAN SIGNALS DIRECTORATE (ASD). ALLMore information
Counter Expertise Review on the TNO Security Analysis of the Dutch OV-Chipkaart. OV-Chipkaart Security Issues Tutorial for Non-Expert Readers
Counter Expertise Review on the TNO Security Analysis of the Dutch OV-Chipkaart OV-Chipkaart Security Issues Tutorial for Non-Expert Readers The current debate concerning the OV-Chipkaart security wasMore information
Building Secure Multi-Factor Authentication
Building Secure Multi-Factor Authentication Three best practices for engineering and product leaders Okta Inc. I 301 Brannan Street, Suite 300 I San Francisco CA, 94107 email@example.com I 1-888-722-7871 IntroductionMore information
Authenticating Humans
29 Oct 2015 CSCD27 Computer and Network Security Authenticating Humans CSCD27 Computer and Network Security 1 Authenticating Computers and Programs Computers and programs need to authenticate one another:More information
Columbia University Web Security Standards and Practices. Objective and Scope
Columbia University Web Security Standards and Practices Objective and Scope Effective Date: January 2011 This Web Security Standards and Practices document establishes a baseline of security related requirementsMore information
PASSWORD MANAGEMENT. February 2008. The Government of the Hong Kong Special Administrative Region
PASSWORD MANAGEMENT February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part withoutMore information
Welcome to the Protecting Your Identity. Training Module
Welcome to the Training Module 1 Introduction Does loss of control over your online identities bother you? 2 Objective By the end of this module, you will be able to: Identify the challenges in protectingMore information
Smart Card- An Alternative to Password Authentication By Ahmad Ismadi Yazid B. Sukaimi
Smart Card- An Alternative to Password Authentication By Ahmad Ismadi Yazid B. Sukaimi Purpose This paper is intended to describe the benefits of smart card implementation and it combination with PublicMore information
The Feasibility and Application of using a Zero-knowledge Protocol Authentication Systems
The Feasibility and Application of using a Zero-knowledge Protocol Authentication Systems Becky Cutler email@example.com Mentor: Professor Chris Gregg Abstract Modern day authentication systemsMore information
Helping you to protect yourself against fraud and financial crime
Helping you to protect yourself against fraud and financial crime first direct takes fraud & other financial crimes very seriously. Even though we have market-leading fraud detection systems, we want youMore information
Research Article. Research of network payment system based on multi-factor authentication
Available online www.jocpr.com Journal of Chemical and Pharmaceutical Research, 2014, 6(7):437-441 Research Article ISSN : 0975-7384 CODEN(USA) : JCPRC5 Research of network payment system based on multi-factorMore information
3D PASSWORD. Snehal Kognule Dept. of Comp. Sc., Padmabhushan Vasantdada Patil Pratishthan s College of Engineering, Mumbai University, India
3D PASSWORD Tejal Kognule Yugandhara Thumbre Snehal Kognule ABSTRACT 3D passwords which are more customizable and very interesting way of authentication. Now the passwords are based on the fact of HumanMore information
Last update: February 23, 2004
Last update: February 23, 2004 Web Security Glossary The Web Security Glossary is an alphabetical index of terms and terminology relating to web application security. The purpose of the Glossary is toMore information
The virtual safe: A user-focused approach to data encryption
The virtual safe: A user-focused approach to data encryption Steganos GmbH, 2008 1 The hard disk: a snapshot of our lives The personal computer has never been more personal. We routinely trust it withMore information
Authentication. Readings. Chapters 9, 10 Sections
Authentication Readings Chapters 9, 10 Sections 11.1-11.3 1 Authentication: Who and How User (human) can be authenticated logging into a workstation using resources of a system issues: humans find it difficultMore information
Application Design and Development
C H A P T E R9 Application Design and Development Practice Exercises 9.1 What is the main reason why servlets give better performance than programs that use the common gateway interface (CGI), even thoughMore information
Egress Switch Best Practice Security Guide V4.x
Egress Switch Best Practice Security Guide V4.x www.egress.com 2007-2013 Egress Software Technologies Ltd Table of Contents Introduction... 4 Best Practice Installation... 4 System Administrators... 5More information
Analysis on Some Defences against SYN-Flood Based Denial-of-Service Attacks
Analysis on Some Defences against SYN-Flood Based Denial-of-Service Attacks Sau Fan LEE (ID: 3484135) Computer Science Department, University of Auckland Email: email@example.com Abstract A denial-of-serviceMore information
6.857 Computer and Network Security Fall Term, 1997 Lecture 17 : 30 October 1997 Lecturer: Ron Rivest Scribe: Alex Hartemink 1 Preliminaries 1.1 Handouts Graded Problem Set 5 returned Solutions to ProblemMore information
The Security Behind Sticky Password
The Security Behind Sticky Password Technical White Paper version 3, September 16th, 2015 Executive Summary When it comes to password management tools, concerns over secure data storage of passwords andMore information
Secure and Safe Computing Primer Examples of Desktop and Laptop standards and guidelines
Secure and Safe Computing Primer Examples of Desktop and Laptop standards and guidelines 1. Implement anti-virus software An anti-virus program is necessary to protect your computer from malicious programs,More information
HP ProtectTools Windows Mobile
HP ProtectTools Windows Mobile White Paper Introduction... 2 Risks... 2 Features... 3 Password Hashing... 4 Password Generation... 5 Password Types... 5 Strong Alphanumeric Passwords... 5 Password Lifetime...5More information
Today. Important From Last Time. Old Joke. Computer Security. Embedded Security. Trusted Computing Base
Important From Last Time A system is safety critical when its failure may result in injuries or deaths Verification and validation can dominate overall development effort Today Embedded system securityMore information
Enhancing Organizational Security Through the Use of Virtual Smart Cards
Enhancing Organizational Security Through the Use of Virtual Smart Cards Today s organizations, both large and small, are faced with the challenging task of securing a seemingly borderless domain of companyMore information
Information Security
Information Security A staff guide to the University's Information Systems Security Policy Issued by the IT Security Group on behalf of the University. Information Systems Security Guidelines for StaffMore information
Guide to Evaluating Multi-Factor Authentication Solutions
Guide to Evaluating Multi-Factor Authentication Solutions PhoneFactor, Inc. 7301 West 129th Street Overland Park, KS 66213 1-877-No-Token / 1-877-668-6536 www.phonefactor.com Guide to Evaluating Multi-FactorMore information
Cloud Services. Email Anti-Spam. Admin Guide
Cloud Services Email Anti-Spam Admin Guide 10/23/2014 CONTENTS Introduction to Anti- Spam... 4 About Anti- Spam... 4 Locating the Anti- Spam Pages in the Portal... 5 Anti- Spam Best Practice Settings...More information
Chapter 9 Key Management 9.1 Distribution of Public Keys 9.1.1 Public Announcement of Public Keys 9.1.2 Publicly Available Directory
There are actually two distinct aspects to the use of public-key encryption in this regard: The distribution of public keys. The use of public-key encryption to distribute secret keys. 9.1 DistributionMore information
Authentication Part 4: Issues and Implications. People and Security Lecture 8
Authentication Part 4: Issues and Implications People and Security Lecture 8 The great authentication fatigue (1) 23 knowledge workers asked to keep a diary of all their authentication events for 24 hoursMore information
RFG Secure FTP. Web Interface
RFG Secure FTP Web Interface Step 1: Getting to the Secure FTP Web Interface: Open your preferred web browser and type the following address: http://ftp.raddon.com After you hit enter, you will be takenMore information
The City of New York
The Policy All passwords and personal identification numbers (PINs) used to protect City of New York systems shall be appropriately configured, periodically changed, and issued for individual use. ScopeMore information
Network Security CS 5490/6490 Fall 2015 Lecture Notes 8/26/2015
Network Security CS 5490/6490 Fall 2015 Lecture Notes 8/26/2015 Chapter 2: Introduction to Cryptography What is cryptography? It is a process/art of mangling information in such a way so as to make itMore information
Configuring Facebook for a More Secure Social Networking Experience
CPF 00009-15-CID361-9H-Facebook* 10 November 2015 Configuring Facebook for a More Secure Social Networking Experience Settings Settings are available under the Facebook Configuration Arrow. General SettingsMore information
What Are Certificates?
The Essentials Series: Code-Signing Certificates What Are Certificates? sponsored by by Don Jones W hat Are Certificates?... 1 Digital Certificates and Asymmetric Encryption... 1 Certificates as a FormMore information
Authentication. Steven M. Bellovin September 27,
Authentication Steven M. Bellovin September 27, 2010 1 Authentication Another trilogy: identification, authentication, authorization ACLs and the like are forms of authorization: what you re allowed toMore information
Part I. Universität Klagenfurt - IWAS Multimedia Kommunikation (VK) M. Euchner; Mai 2001. Siemens AG 2001, ICN M NT
Part I Contents Part I Introduction to Information Security Definition of Crypto Cryptographic Objectives Security Threats and Attacks The process Security Security Services Cryptography Cryptography (codeMore information
User Identification and Authentication Concepts
Chapter 1 User Identification and Authentication Concepts The modern world needs people with a complex identity who are intellectually autonomous and prepared to cope with uncertainty; who are able toMore information
CSE543 - Introduction to Computer and Network Security. Module: Reference Monitor
CSE543 - Introduction to Computer and Network Security Module: Reference Monitor Professor Trent Jaeger 1 Living with Vulnerabilities So, software is potentially vulnerable In a variety of ways So, howMore information
nwstor Storage Security Solution 1. Executive Summary 2. Need for Data Security 3. Solution: nwstor isav Storage Security Appliances 4.
CONTENTS 1. Executive Summary 2. Need for Data Security 3. Solution: nwstor isav Storage Security Appliances 4. Conclusion 1. EXECUTIVE SUMMARY The advantages of networked data storage technologies suchMore information
Homeland Security Red Teaming
Homeland Security Red Teaming Directs intergovernmental coordination Specifies Red Teaming Viewing systems from the perspective of a potential adversary Target hardening Looking for weakness in existingMore information
Understanding Digital Signature And Public Key Infrastructure
Understanding Digital Signature And Public Key Infrastructure Overview The use of networked personnel computers (PC s) in enterprise environments and on the Internet is rapidly approaching the point whereMore information
INTRODUCTION TO CRYPTOGRAPHY AUTHOR: ANAS TAWILEH firstname.lastname@example.com Available online at: http://www.tawileh.net/courses/ia This work is released under a Creative Commons Attribution-ShareAlike 2.5 LicenseMore information
INTERNET & COMPUTER SECURITY March 20, 2010. Scoville Library. firstname.lastname@example.com
INTERNET & COMPUTER SECURITY March 20, 2010 Scoville Library firstname.lastname@example.com Internet: Computer Password strength Phishing Malware Email scams Identity Theft Viruses Windows updates Browser updates BackupMore information
FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and SecurityMore information
White Paper. Options for Two Factor Authentication. Authors: Andrew Kemshall Phil Underwood. Date: July 2007
White Paper Options for Two Factor Authentication Authors: Andrew Kemshall Phil Underwood Date: July 2007 Page 1 Table of Contents 1. Problems with passwords 2 2. Issues with Certificates (without Smartcards)More information
KERBEROS. Kerberos Authentication Service
KERBEROS 1 Kerberos Authentication Service Developed at MIT under Project Athena in mid 1980s Versions 1-3 were for internal use; versions 4 and 5 are being used externally Version 4 has a larger installedMore information
Kentico CMS security facts
Kentico CMS security facts ELSE 1 www.kentico.com Preface The document provides the reader an overview of how security is handled by Kentico CMS. It does not give a full list of all possibilities in theMore information
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-More information
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White PaperMore information
RemotelyAnywhere. Security Considerations
RemotelyAnywhere Security Considerations Table of Contents Introduction... 3 Microsoft Windows... 3 Default Configuration... 3 Unused Services... 3 Incoming Connections... 4 Default Port Numbers... 4 IPMore information
W.A.R.N. Passive Biometric ID Card Solution
W.A.R.N. Passive Biometric ID Card Solution Updated November, 2007 Biometric technology has advanced so quickly in the last decade that questions and facts about its cost, use, and accuracy are often confusedMore information
Network Security - ISA 656 Email Security
Network Security - ISA 656 Angelos Stavrou November 13, 2007 The Usual Questions The Usual Questions Assets What are we trying to protect? Against whom? 2 / 33 Assets The Usual Questions Assets ConfidentialityMore information
Getting a Secure Intranet
61-04-69 Getting a Secure Intranet Stewart S. Miller The Internet and World Wide Web are storehouses of information for many new and legitimate purposes. Unfortunately, they also appeal to people who likeMore information
Secure Password Reset in a Multiuser Web Application
Secure Password Reset in a Multiuser Web Application Francisco Corella June 2007 Patent Granted Abstract This white paper presents a solution to the user lockout problem in the context of a multiuser WebMore information
Multi Factor Authentication API
GEORGIA INSTITUTE OF TECHNOLOGY Multi Factor Authentication API Yusuf Nadir Saghar Amay Singhal CONTENTS Abstract... 3 Motivation... 3 Overall Design:... 4 MFA Architecture... 5 Authentication Workflow...More information
Protecting Online Customers from Man-inthe-Browser and Man-in-the-Middle Attacks
Protecting Online Customers from Man-inthe-Browser and Man-in-the-Middle Attacks Whitepaper W H I T E P A P E R OVERVIEW Arcot s unmatched authentication expertise and unique technology give organizationsMore information
Kaspersky Lab s Full Disk Encryption Technology
Kaspersky Lab s Full Disk Encryption Technology In the US alone, an estimated 12,000 laptops are lost or stolen each week. According to the Ponemon Institute, a laptop is stolen every 53 seconds; moreMore information
Web Plus Security Features and Recommendations
Web Plus Security Features and Recommendations (Based on Web Plus Version 3.x) Centers for Disease Control and Prevention National Center for Chronic Disease Prevention and Health Promotion Division ofMore information
Victor Shoup Avi Rubin. fshoup,firstname.lastname@example.com. Abstract
Session Key Distribution Using Smart Cards Victor Shoup Avi Rubin Bellcore, 445 South St., Morristown, NJ 07960 fshoup,firstname.lastname@example.com Abstract In this paper, we investigate a method by which smartMore information
The Case For Secure Email
The Case For Secure Email By Erik Kangas, PhD, President, Lux Scientiae, Incorporated http://luxsci.com Contents Section 1: Introduction Section 2: How Email Works Section 3: Security Threats to Your EmailMore information
SY0-201. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users.
system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users. From a high-level standpoint, attacks on computer systems and networks can be groupedMore information
InfoCenter Suite and the FDA s 21 CFR part 11 Electronic Records; Electronic Signatures
InfoCenter Suite and the FDA s 21 CFR part 11 Electronic Records; Electronic Signatures Overview One of the most popular applications of InfoCenter Suite is to help FDA regulated companies comply withMore information
Online Banking Customer Awareness and Education Program
Online Banking Customer Awareness and Education Program Electronic Fund Transfers: Your Rights and Responsibilities (Regulation E Disclosure) Indicated below are types of Electronic Fund Transfers we areMore information


text:
Warner Bros. Intl. Television Distribution has signed a multi-year free television deal with Greece's privately owned station Star Channel, it was announced Wednesday.
The deal includes rights to feature films and TV series including "ER," "The Sopranos," "The West Wing" and "The Fugitive," animated series including a branded "Warner Hour" of classic and contemporary animation, TV movies, miniseries and documentaries.
Announcing the deal, WBIT prexy Jeffrey R. Schlesinger said, "Our product has thrived on Star Channel for many years, and I am pleased that they will have more of our programming through this deal."
WBIT licenses more than 39,000 hours of television programming and movies dubbed or subtitled into more than 40 languages to broadcasters in more than 175 countries.

subset: commoncrawl


text:
Meet Nick Botner- Gaia GPS UX Engineer
We're excited to welcome long-time Gaia GPS user Nick Botner to the team. As the first ever user-interface focused employee at Gaia GPS, Nick ushers in a great transformation for Gaia GPS UX and visual design. Previously, Nick worked at Google, where he led a team of Visual Designers working on the Google Cloud Console.… Read More »


text:
Sign in to retrieve a saved callback list.
Scores based on 71 reviews
Invoice history based on 60 reviews.
Fully qualified, 9 years experience, reliable electrician who provides quality domestic electrical work. Any job is undertaken with great attention to detail. Please call anytime for a free quote, weekdays weeknights or weekends.
Southampton, Hampshire


text:
- Autonomic Disorders (.pdf)
- Behavioral Neurology & Neuropsychiatry (.pdf)
- Clinical Neuromuscular Pathology (.pdf)
- Geriatric Neurology (.pdf)
- Headache Medicine (.pdf)
- Neural Repair and Rehabilitation (.pdf)
- Neurocritical Care (.pdf)
- Neuroimaging (.pdf)
- Neuro–oncology (.pdf)
All certificates are time–limited and expire on December 31, 10 years after the date of issuance. Please contact us at 612–928–6399 or email@example.com if more information or written verification is required.
Physician Advertising
Each State Medical Board has different policies and guidelines for physician advertising regarding certification. Contact your State Medical Board for more information.
Alphabetical List of State Medical Boards


text: Sup I would like to introduce myself I am a know it all sort of like a Rush Limbaugh. Not to toot my own horn but I really should go to a broadcasting school and try to become a radio talk show host. You will find my writings or discussion very entertaining and no matter what board I may go on I always stand out among all others. The cream does rise to the top and if I decide to post here a lot I will quickly become one of the best known posters here. Most people will dislike me though but just like in radio it is who reads or listens that counts. I have a natural gift for expressing myself and you will find what I have to say very interesting and entertaining. I will have more to say later please look for my posts and always look for the name bobmilin.


text:
Artist creates feudal Japanese Looney Tunes characters
The Looney Tunes is a true American classic, about as American as you can get. But one curious artist wondered what it would look like if Bugs Bunny and Co. were actually from somewhere completely different, like say, feudal Japan, so he decided to just draw them that way and see for himself.
Animation characters become synonymous with where they're from, and it's not that often you imagine them being from anywhere different or speaking another language. Sure, popular cartoons and animation are translated into different languages, but their settings of daily life are usually the same.
What artist D3.1415926 did was draw illustrations of a number of Looney Tunes characters as coming from feudal Japan, where the samurai used to walk around with their swords at their sides, ready to fight to the death at any time. The Japanese Bugs Bunny, Daffy Duck, Tasmanian Devil, and Marvin the Martian all look ready to go to war too, ready to cause mayhem on the streets of Edo.
To see more of this artist's work, check out http://d3-14.tumblr.com/.
Daffy Duck desu!
When a prosecutor discovers he has months to live, can he turn his life around and tear down corruption? Find out in the gripping melodrama Punch:
Marvin the Martian san
Japanese Devil


text:
As a young boy, I was taught in high school that hacking was cool.
I think it goes back to my high school days. In computer class, the first assignment was to write a program to print the first 100 Fibonacci numbers. Instead, I wrote a program that would steal passwords of students. My teacher gave me an A.
So the ethic I was taught in school resulted in the path I chose in my life following school.
Follow AzQuotes on Facebook, Twitter and Google+. Every day we present the best quotes! Improve yourself, find your inspiration, share with friends
or simply:


text:
Heels On Upset Alert
Feb. 18, 2009
(AP) - Behind Ty Lawson's stellar play over the past month, North Carolina's awful ACC start is a distant memory and a third straight conference title is in sight.
Lawson looks to continue his surge and lead the third-ranked Tar Heels to their 10th straight victory Wednesday night when they host North Carolina State.
North Carolina (23-2, 9-2) opened a two-game conference lead with five contests remaining following Sunday's 69-65 win at Miami, coupled with losses for Duke and Clemson earlier in the day. The Tar Heels have come a long way since opening league play with consecutive losses to Boston College and then-No. 4 Wake Forest.
"Better than being two games behind like it was when we started," North Carolina coach Roy Williams said.
The Tar Heels took control of the ACC in last Wednesday's 101-87 victory at Duke. Lawson scored 21 of his season-high 25 points after halftime against the Blue Devils, and had another clutch performance Sunday.
While All-American Tyler Hansbrough was held to eight points and four rebounds, Lawson scored 17 of his 21 points in the second half, including the game-sealing 3-pointer with 10.6 seconds left.
The Hurricanes pulled within one point on three separate occasions in the final 5 minutes, but each time Lawson made a 3-pointer, part of his 5-for-7 effort from beyond the arc in the second half.
As Lawson goes, seemingly so go the Tar Heels.
The junior point guard is averaging 17.8 points on 61.6 percent shooting -- including 57.6 percent from 3-point range -- and 6.3 assists during North Carolina's nine-game winning streak. He averaged 9.5 points, 4.5 assists, 4.0 turnovers and shot 28.0 percent in the two losses.
"He is the glue to their team," North Carolina State coach Sidney Lowe said. "What I've seen in him is a player that's certainly capable of doing a lot, but he knows he's got a lot of help around him. He's doing his thing and playing his role, but if you notice where the team ever gets into some type of lull, you'll see him get even more aggressive."
Lawson had 16 points and five assists in a 93-76 win over the Wolfpack (14-9, 4-6) on Jan. 31 in Raleigh.
Hansbrough had one of his better games of the season against NC State, finishing with 31 points while shooting 12-for-17 and adding six rebounds. The 6-foot-9 senior is averaging 25.3 points and 10.3 boards in three games against the Wolfpack since the start of last season.
The Tar Heels have won five straight over NC State since an 83-79 loss on Feb. 3, 2007, 11 of the last 12 meetings overall, and five straight at home in the series. However, this time the Wolfpack travel to Chapel Hill on a bit of a roll.
After beating then-No. 7 Wake Forest 82-76 last Wednesday, NC State defeated Georgia Tech 86-65 on Saturday for its first ACC road victory of the season.
The Wolfpack shot a season-high 61.4 percent from the floor and made 9 of 17 3-point attempts in the win over the Yellow Jackets. They are averaging 85.5 points on 52.1 percent shooting in their last four games.
Courtney Fells had a team-high 22 points against North Carolina 2 1/2 weeks ago, while NC State leading scorer Brandon Costner finished with 13.
Costner, who is averaging 15.0 points, scored 10 on Saturday.
The Wolfpack, who are 1-4 against ranked opponents this season, have not won three consecutive conference games since winning five in a row Jan. 21-Feb. 8, 2006.


text:
Small (5%)
high risk
* Always check the full terms & conditions on the betting website Switch Odds type: percentage / example / decimal
Stats for the NPME and BD as they've appeared on Tipify
Not sure if this is a joke, 84% for an extremely inconsistent CIS team? They're playing against a team I've never heard of and that's even more scary. I mean, sure, BD should be able to outfrag them but we have to keep in mind, this is CIS, whenever you see a huge upset then 6/10 times it's from a CIS match. This is going to be StarSeries, and that's a pretty big league for a team like BD, but even then I wouldn't trust them with my skins and again, 84% on lounge is not a CIS team deserves. Going with an ICB on NPME here.
My odds for this match: NPME 30:70 BD
Small (5%)
high risk
Token Bet
Pick the team with the lowest odds, place a small amount of money you don't mind losing.
Should be an easy win for BD, but to be honest would you ever want to bet max or LARGE on a game like this? I don't really know their opponents, but they don't seem that impressive from looking at their results. This SHOULD be an easy win for BD, even if they did lose one of their best players recently, but I would highly recommend not to bed on this game unless you ICB on the underdog to purely hope for an upset.
My odds for this match: NPME 25:75 BD
Token Bet
Pick the team with the lowest odds, place a small amount of money you don't mind losing.
Recommended team:
Stake Size:
Every month we give out prizes to the top community tipsters
You can get involved too, just use the bet tracker on the left to make your prediction for this match.
Compete against 1,000s of other tipsters from all over the world and see how you compare.
See this months Leaderboard
Recommend rules for betting:
Max: 20%, Large: 15%, Medium: 10%
Small: 5% & ICB: 1% or lower


text:
if(1==2){ ?>
} ?>
+90 392 630 1346 / 630 2039 / 630 1049
+90 392 630 2365
left the congress
Keynote speakers anounced.
Deadline for abstract submission is postponed to 11 November 2013.
Useful Links
About Cyprus
How to come?
Home Page
Accommodation & Registration
Full Paper
Contact Us
An International Conference on Architectural Education with the theme of
"Unspoken Issues in Architectural Education"
will be held at the Faculty of Architecture, Eastern Mediterranean University in collaboration with the European Association for Architectural Education (EAAE) in Gazimagusa (Famagusta), North Cyprus, on April 3-4, 2014. The meeting is organized with the intention that scholars, practitioners and students will come together for discussing architectural education from various perspectives.
To this end, the Conference will be pleased to consider proposals from interdisciplinary scholars, practitioners and students from all around the world working in the disciplines of design, architecture, art & architectural history, engineering, urban studies, cultural studies, sociology, environmental studies, or pedagogical studies.
This conference is intended to aid in the advancement of discussions on several critical issues in architectural education, with the main themes of "Diversified Mediums", "Dynamic Philosophy", and "Contradictory Education". In view of these main themes, the main objective of the conference is to investigate and disseminate key challenges of architectural education in present time such as; the (ir)relevance of architectural education to the real world, the effects of media, working or designing for the poor, disaster management, climate change, fuel poverty, the price of energy, conflicts and wars, number of architects and architectural schools, questioning the methodology of teaching in architecture and many more "unspoken" issues.
The Conference is also intended to support the publication and expansion of knowledge and experiences in architectural education. In this respect, 14 papers (which must have been presented at the conference) selected by the scientific committee will be published in
Open House International Journal
(AHCI and SSCI,
); four papers in April, 2014 and then ten papers in a special issue of the same journal in mid-2015. In addition, all papers presented in the conference will be published in a proceedings book/CD.
if(1==2){ ?>
} ?>