[2149] in Kerberos
Re: New User Accounts
daemon@ATHENA.MIT.EDU (Derek Atkins)
Wed Sep 2 16:13:02 1992
To: dean@ksr.com
Cc: Derek Atkins <warlord@Athena.MIT.EDU>, kerberos@Athena.MIT.EDU,
In-Reply-To: Your message of Wed, 02 Sep 92 15:33:46 -0400.
Date: Wed, 02 Sep 92 15:49:40 EDT
From: Derek Atkins <warlord@MIT.EDU>
The point of using SecurID is so that you don't HAVE to type your
password in the clear over the net. Granted, this might allow one to
obtain a tgt using SecurID as the password (instead of the normal
login password), however this doesnt solve the problem of
re-authentication.
Once you are logged in, if you want to reauthenticate, someone can
watch as you type your password. Since the SecurID password is
changed every minute, and is only good once, that isn't a problem,
however to use your SecurID code as the password would require major
hacking of the kerberos server and would probably make it incompatible
with the current system. (I.e., how does the server know whether or
not to expect a SecurID password or not).
The solution here is not a simple one, so suggestions are open!
(The real solution is to throw away SecurID as a method of
login-password-authentication and extend kerberos all the way across
the modem to the terminal.)
-derek
