Two Factor Authentication for Software Installation.

The current solution to the problem of malware self installing itself has been to add a level of authentication or consent to the installation process. Requiring the user to provide the administrator details or to click an agreement to change security levels to enable an installation appears to be a good level of security until you realise that users are simply going to ‘go ahead’ assuming that the software is safe.

 

I would challenge the software industry that it needs to build into its installation or upgrade process a two factor process that first requires the user to enter a passphrase that has been set by the user and stored with the software developer accessible via a unique one time string provided by the developer. In short we are adding a level of effort to the installation process that allows the developer to confirm that they are the ones delivering that update.

An example of this;

.

 

Dropbox requires me to install an upgrade; as part of that process I set the passphrase on Dropbox website fro the machine I am installing and get a short code back in response. I enter that shortcode back into the upgrade ( this is before I have entered a administrator passphrase ) and the upgrade if valid would talk with the software provider by way of this code effectively  authorising the code. Checking back on the website I could see if the passphrase was accepted and continue. Now there is a LOT of overhead in this process but the benefits of security and authenticity should outweigh the costs. This process could be extended into a process/gateway broker system which could be used by system administrators to globally manage machine upgrades and to ensure that machines can be additionally locked down whilst pre approving upgrades.

No doubt people will tell me this wont work but I challenge them to consider a better proposal.

 

Thanks for reading.