My next class:

RSA Offers to Replace Tokens

Published: 2011-06-07. Last Updated: 2011-06-07 13:43:22 UTC
by Johannes Ullrich (Version: 1)
5 comment(s)

RSA issued a press release, offering to replace all tokens if a customer asks for it. As an alternative, RSA also offers to implement additional authentication monitoring.

Aside from the press release, and an interview with the RSA CEO, there have not been any details about how this would work or how long it will take. However, RSA states that this will cover all customers, even if RSA considers them not at risk.

 

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

Keywords: rsa two factor
5 comment(s)
My next class:

Comments

So after months of saying customers were still secure and there was no need to replace tokens, RSA finally admits they have been lying to their customers and the public all along.

And why should we now believe anything they have to say?

Anonymous

Jun 7th 2011
1 decade ago

Original link from RSA is here ==> http://www.rsa.com/node.aspx?id=3891

Rob VandenBrink

Jun 7th 2011
1 decade ago

My company immediately increased the pin length to help mitigate the risk.

It will be interesting to see if we accept the offer of new tokens, we have thousands of them.

Larry

Jun 7th 2011
1 decade ago

So they will replace Tokens for free?
Hopefully with replacement authentication server and brand new tokens produced, everything using key material generated after intruders were locked out, and a promise they haven't kept record of sufficient information for anyone to replicate the replacement tokens?


It would seem pointless if they're offering to replace potentially compromised tokens with (still potentially compromised) tokens from their warehouse,
but stranger things have happened.



Mysid

Jun 7th 2011
1 decade ago

I've always been suspicious of RSA's promises. Now with confirmation of not only their grossly-lax internal security, but also of their ongoing lies and deceptions, I have no choice but to strongly recommend against any possible future RSA implementation which requires any level of security higher than simple shared passwords.

GJB

Jun 8th 2011
1 decade ago

Login here to join the discussion.


Top of page
Diary Archives