CertAnon The feasibility of an anonymous WAN authentication service Red Group CS410 March 1, 2007

Our Team 3/1/2007 Red Group 2

Threatening News 1/5/2007: In an Instant, Retirement Savings Vanish 2/15/2007: Online Identity Stolen 2/20/2007: Phishers Targeting MySpace 2/23/2007: Free Wi-Fi scam hitting airports 2/26/2007: Trojan Horse Designed to Steal Usernames and Passwords 3/1/2007 Red Group 3

How About You? How many online accounts do you have? How many passwords do you have to remember? How do you manage them? 3/1/2007 Red Group 4

The Problem Single-factor password authentication is easily compromised and endangers the security of online accounts. –Username/Password paradigm is insecure 1 –Management of multiple strong passwords is difficult for individuals –Fraudulent online account access is increasing 3/1/2007 Red Group

The Endangered Password More online accounts = more passwords Complexity of passwords is limited by the human factor 2 Vulnerability is enhanced by the technology factor Dissemination is too easy Once compromised, a password is no longer effective for authentication 3/1/2007 Red Group

Going Phishing Phishing sites are on the rise 3 Over 7 million phishing attempts per day 3/1/2007 Red Group 7 3. Anti-Phishing Working Group -

CertAnon - A New Proposal Anonymous WAN authentication service –Used for any and all online accounts –Strong two-factor authentication –Limited information sharing Partner with online businesses Initial customers are Internet users 3/1/2007 Red Group 8

Goal and Objectives Build a WAN authentication service that permits customers to securely access all of their online accounts using a single access method –Build our website –Write software modules for partner sites –Develop testing portal –Install authentication servers –Distribute tokens –Beta-testing, then go live! 3/1/2007 Red Group 9

What Would It Look Like? 3/1/2007 Red Group 10

Two-factor Authentication 4 Something you know –A single PIN Plus something you have –Hardware token generating pseudo- random numbers Effectively changes your password every 60 seconds 3/1/2007 Red Group RSA -

3/1/2007 Red Group 12

3/1/2007 Red Group 13 Token Setup Process

3/1/2007 Red Group 14 Account Setup Process

Who is Our Customer? Individual Internet User –Purchases CertAnon token for one-time fee of $50 Obtaining a critical mass of customers makes CertAnon a must have for online vendors –Could give leverage to charge vendors in the future 3/1/2007 Red Group 15

About the Customer 3/1/2007 Red Group 16 % 5. Internet World Stats Clickz.com Clickz.com RSA Security Password Management Survey -

Why Will The Customer Care? Reduce/eliminate need for multiple passwords Avoid password theft and unauthorized account access No information stored on a card that can be lost No password database to be hacked 3/1/2007 Red Group 17

What’s in it for a business? 3/1/2007 Red Group 18 It’s free No need to implement a costly proprietary solution Improves security of customer base by moving more people away from passwords Snaps into existing infrastructure with minimal development Customers who don't switch will be unaffected

Competition Matrix 3/1/2007 Red Group 19

Cons Still not perfectly secure Token trouble –Forgotten –Broken –Lost or stolen Inadequate for sight-impaired users 3/1/2007 Red Group 20

Risks & Mitigation 3/1/2007 Red Group 21 ImpactImpact Probability (1-Low to 5-High) #RiskMitigation 1TrustBeta-testing 2Customer understanding Tutorials on website 3Reliance on token sales revenue Encourage early partner site adoption 4Viable alternativesSingle source two-factor 5 Token lossProvide temporary password access 6Token availabilityOffer online and through retail outlets 7Government vs. Anonymity Follow the lead of encryption products

Costs & Revenue 3/1/2007 Red Group 22 Servers$16,000 RSA training$1, developers (3yr)$600,000 Server/application admin (3yr)$414,000 Co-location and access costs (3yr)$144,000 RSA Authentication Manager (3yr)*$3,600,000 Tokens* and Total * $34,775,600 Revenue*$50,000,000 *Based on sales of one million tokens

Conclusion Available, affordable, and proven technology Targets a large and growing market Benefits consumers and online businesses Manageable project scope, scaleable product 3/1/2007 Red Group 23

References “Failure of Two-Factor Authentication.” Schneier on Security. 12 Jul Bruce Schneier. 28 Jan “Internet Penetration and Impact.” Pew/Internet. April Pew Internet & American Life Project. 28 Jan “Internet Statistics Compendium - Sample.” E-consultancy.com. 9 Jan E-consultancy.com LTD. 28 Jan “Internet World Stats.” Internet World Stats. 11 Jan Internet World Stats. 15 Feb “Online Banking Increased 47% since 2002.” ClickZ Stats. 9 Feb The ClickZ Network. 15 Feb /1/2007 Red Group 24

References (cont.) “Phishing Activity Trends: Report for the Month of November, 2006.” Anti-Phishing Working Group. Nov Anti-Phishing Working Group. 28 Jan “Real-World Passwords.” Schneier on Security. 14 Dec Bruce Schneier. 28 Jan “RSA SecurID Authentication.” RSA Security RSA Security, Inc. 28 Jan “RSA Security Password Management Survey.” RSA Security. Sep Wikipedia. 15 Feb “Rural America Slow to Adopt Broadband.” ClickZ Stats. 27 Feb The ClickZ Network. 28 Feb /1/2007 Red Group 25