Dual authentication with one-time password

Dual passwords can keep phishers at bay

After South Carolina’s Department of Revenue was hacked in November, exposing 3.8 million Social Security numbers, 387,000 credit and debit card numbers and 657,000 business tax filings, state officials announced plans to implement a dual-authentication password system to better protect information.

What the state had at the time of the attack offered next to no security: a single-password security system, with almost none of the data encrypted.

A simple phishing attack gained access to one employee’s user name and password, and the hackers were off to the races, allegedly accessing the financial system at will for well over a month before the hack was discovered, according to The State newspaper.

Federal agencies have two-factor authentication, the second factor in the form of a token such as a Personal Identity Verification card (civilian agencies) or Common Access Card (defense). But public-sector agencies without that kind of protection could turn to dual password systems.

There are two main dual-authentication password systems in use today, outside of  biometrics.

The method frequently used by banks, online games and any site with high-value transactions is called one-time password. It’s almost always used as a second line of defense behind the usual name and password protection. The key is that the second password changes very often, sometimes as quickly as every minute, but certainly no less than every 90 seconds. A security server uses a mathematical algorithm to keep changing the password. Of course, users need to know that changing password, and this information is given to them via a portable device that can both keep track of time and has the same mathematical formula as the server. So the mobile device and the security server come up with the same numbers at the same time.

For a user to get access to a protected system, he has to enter the right password at the right time. Some fancy password systems include a USB key or a smart card as part of the mobile device, and a user has to insert the token into a system he is using to access the data, whereby the password is automatically applied.

If the password on the token matches the current one on the security server, access is granted. This makes it almost phishing-proof because even if a user somehow gives out the second password, it’s only valid for a very short time. And in the case of the automatic passwords, a user probably never actually knows what the rotating passwords are. He just inserts his key to gain access. A phisher or hacker who gains the primary password doesn’t get into the system, and attempts to break the second password after the first is approved will trigger alarm bells in any halfway decent monitoring setup.

The second method involves encrypting all files and folders with a program such as BitLocker,  in which encryption acts like the second password. If a hacker is able to access a system, say, by using a phishing attack, he still doesn’t get anywhere. All the files will be encrypted gibberish.

The value of this system is that even if someone steals all of the files, he likely won’t be able to make use of them because of the encryption protecting the data. It also makes data monitoring systems more effective because they can detect if someone accesses a system properly, but then runs into walls each time he tries to use a file.

In truth, a system like the one in South Carolina that protects Social Security information and tax records can never be too protected. It should probably have both secondary password methods in use, for a triple-security login, plus system monitoring. But either of the two methods alone would have stopped the rather unsophisticated attack on the South Carolina system had it been in place at the time of the breach. The state just made it easy for the hacker, and provided a valuable lesson in what not to do.

About the Author

John Breeden II is a freelance technology writer for GCN.

inside gcn

  • cloud view of Omaha

    Local government's cloud move cuts headaches, adds control

Reader Comments

Tue, Dec 11, 2012

Obama is very forward thinking when it comes to security and cyberspace. But the guy from South Carolina is talking about his home state, so the president does not really apply. It sure sounds like the tea party messed up SC. Glad I'm not there.

Tue, Dec 11, 2012

Tea Party's fault? Why not blame Bush? Wait til "O" gets hold of that money!

Mon, Dec 10, 2012 Allen South Carolina

You forgot to mention that the reason there was no protection on our system was the fact that the Tea Party lunkheads took over the state government, and they refused to spend a tiny bit of money to protect the data for fear that it would lead to "big government." Instead they exposed all of us who live here to possible identity fraud, and have to pay $18 million in services like Lifelock to try and chase the horse after it left the barn. The first system you talk about would have cost the state $25,000. For want of that, they sold us out and cost themselves almost 20 million. There will be a reckoning in the next election, if not sooner. Jim DeMint flew the coop because he sees what is coming. We are going to put real republicans in place or even turn the place blue in 2014. Then crap like this won't happen anymore.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above