Re: [Otpasswd-talk] Using OTP to kind of fix MITM.

[Luke Faraone]

On Tue, Dec 22, 2009 at 16:52, Hannes Beinert <address@hidden> wrote:

 I think that
properly authenticating the host is too important, and it's worthwhile
making it as easy as possible for the user.  And it does seem awfully
cumbersome to squeeze it into the existing passcard page

Agreed. I don't think it's possible with today's technologies to log in securely when your adversary is not only able to intercept, but to also actively participate in the connection unless the host party is authenticated via well-tested public key crypto. Inventing other solutions, such as a challenge-responce passcard system, are moot unless the transmission is secure.

The use cases OTPasswd should prevent against, in my opinion, are ones of hardware keyloggers, shoulder surfers, or other passive attackers. Active attackers are a solved problem from a technical standpoint; it's now just all a matter of getting people to follow procedure. 

-- 
Luke Faraone
http://luke.faraone.cc