About the Book
Please note that the content of this book primarily consists of articles available from Wikipedia or other free sources online. Pages: 29. Chapters: Activated Content, Atomic authorization, Authentication protocol, Billion laughs, Black Hat Briefings, Blended threat, CDP Spoofing, Certified Computer Examiner, Code audit, Computer Security Institute, Conference on Email and Anti-Spam, Contact scraping, Cracktivism, Cryptographic log on, Cyber Security Task Force, Daniel B. Cid, Data Security Council of India, Digipass, Distributed Access Control System, DOD Information Assurance Certification and Accreditation Program, Draw a Secret, DREAD: Risk assessment model, Dynablock, EAuthentication, Ekoparty, Extensible Threat Management (XTM), Firewalk (computing), Flaw hypothesis methodology, Forward anonymity, Full disclosure (mailing list), Global Trust Council, Hack.lu, Hacker Halted, Heap feng shui, Hi-Tech Crime Enquiry Cell, High-water mark (computer security), Information Card Foundation, Initiative For Open Authentication, JIT spraying, Keystore, Kippo, Light-Weight Identity, Location-based authentication, Logical access control, Mutual authentication, NemID, Network intrusion detection system, Nguyen Quang Huy, One-time authorization code, OneLogin, OpenAM, OpenDJ, OpenIDM, OpenSSO, PassWindow, Penny Black (research project), Pete Finnigan, Point of Access for Providers of Information, Pubcookie, Salute picture, Secure Trusted Operating System Consortium, Security store, Security Token Service, SPNEGO, Spring Security, System Reconfiguration Attacks, Transaction authentication, Transaction verification, Trust boundary, TUPAS, U-Prove, Vulnerability database, Wargame (hacking), Wilmagate. Excerpt: PassWindow is a technique of producing one-time passwords and facilitating transaction verification that is used as an online second-factor authentication method. The system works by encoding digits into a segment matrix similar to the seven-segment matrices used in digital displays. The matrix is then divided into two component patterns that reveal the whole when superimposed. Half of the pattern is printed on a transparent region of a plastic card, while the other is displayed on an electronic screen such as a computer monitor. These are referred to as the key pattern and challenge pattern, respectively. Each key pattern is unique, and the challenge pattern can only be decoded by its corresponding printed key. By varying the challenge pattern displayed on the screen, a series of digits can be communicated to the card holder without being visually revealed on the screen. PassWindow is typically implemented such that an animated, perpetually looping sequence of challenge patterns is displayed, each encoding a single digit placed in a random location within the matrix. A valid solution to this challenge then consists of a specified number of consecutively appearing digits. By printing a PassWindow key pattern on a piece of transparent media, such as a transparent section of a plastic card, a standard plastic ID-1 card can be used as physical token ( something you have) that can be used in a two-factor authentication system. Using the PassWindow system, a challenge pattern containing a string of digits and/or letters can be generated for a specific key pattern by an authentication server with knowledge of the shared secret (the user's key pattern). The user decodes the sequence of digits from the pattern using their PassWindow key and sends this as a response to the server's challenge. The correct response confirms that the client has physical access to the token. These digits are then used as a one-time password. Mutual authentication or two-way authentication (somet
