Authenticated Apache

November 17, 2004 —

Anyone here feel comfortable using standard HTTP usernames and passwords to control access to digital products on Web servers? I'm not talking about encrypted connections via SSL, I'm talking about being absolutely sure the username and password is the person you think it is. How do you know the user typing a username and password into your Web site is the person who purchased access to the products?

Enter two-factor authentication for Apache Web servers from CryptoCard (.com). I talked back in April about their products, and now they have a security module for Apache Web servers that uses any or all of their client authentication tokens: smart card, USB dongle, keychain fob, or software. They announced their Crypto-Server 6.2 at ApacheCon recently, and by the time you get this their resellers should have product.

Why the focus on Apache? Because, says Malcolm MacTaggart, CEO of CryptoCard, "13.5 million of the 18 million Web sites we can find run Apache." Yes, the company has a module for IIS from Microsoft, but prefers to focus on securing Apache.

How will this work? Just like their other two-factor authentication products. A client goes to a Web site, such as a market research database, and logs in. When asked, they query the CryptoCard client token, such as plugging in the USB dongle, for authentication. The CryptoCard server software provides authentication, and the database owners know that the person getting information is the person who paid for information.

Is this B2B or B2C? Yes. I believe the market will first go to B2B, since businesses often worry about extranets because they don't know what's happening on the far end of the connection. But a CryptoCard token, such as the smart card used by companies as a passkey for company doors, validates the far end client completely.

Pricing will push this toward B2B use at first. The server side will cost under $30 per seat, and the client tokens cost anywhere from $20 for software up to $99 for a smart card and reader starter kit. Volume users can get the total cost down to $40 without much problem, but that's still steep for consumer authentication.

Would you pay $40 per user to be sure the traveling executive accessing your financial records is really your executive? Sounds like a bargain to me.

James

ITworld.com, Enterprise Networking