The textual password system that we have long relied upon is difficult to manage.
1. Most of us are apt to use weak passwords such as password, 123456, 12345678, qwerty, abc123, monkey, 1234567, letmein, trustno1, dragon, baseball, 111111, iloveyou, master, sunshine, ashley, bailey, passw0rd, shadow, 123123,654321, superman, qazwsx, michael, football
2. If told to use strong passwords, most of us would write them down.
3. If told not to write them down, most of us would reuse them.
4. If told not to reuse them, most of us would go back to weak passwords or writing them down.
We could think of 3 scenarios for getting out of this cycle.
Ａ． Eliminate memory-based authentication altogether.
Ｂ． Add something to the password system.
Ｃ． Improve or expand the password system.
Let us look at each of them closely.
Ａ． There are two ways to go: token solutions and biometric solutions.
If possession of a genuine token can be considered to be sufficient for identity authentication in the outdoor environment, we should be allowed to withdraw bank deposits only by presenting a genuine bank card, say, without presenting PIN codes or passwords. How much would you dare to deposit with such a bank account? I am of the view that the token solutions coming without passwords should be limited to applications of low-security requirements.
Biometric devices coming without rescue passwords would have to be operated with the minimal false rejection, which would automatically mean the maximal false acceptance. I am of the view that the biometric solution coming without passwords should be limited to low-security applications.
Ｂ．There are two ways to go: Single-Sign-On/Password Manager and Multi-Factor Authentications
SSO/PWM would certainly help, but at a cost. We do not love to imagine what would happen if the master password is broken/stolen.
Multi-Factor Authentication would certainly help, a lot in the indoor environment, but not much in the outdoor environment where the token and the mobile devices which the token is expected to protect are at 100% probability on/around the clothes or bags of the person who carries them around. We should not expect attackers to be ignorant of this.
I do not think that the combination of biometric devices and rescue passwords can be called a two-factor authentication.
Ｃ． There are two ways to go: think about better ways to use textual passwords and expand the password system to incorporate non-textual objects
Many tips are provided on how to create easy-to-remember and yet difficult-to-break passwords. I have myself tried many of them. Such passwords may well be practicable indeed in a peaceful environment where bosses do not roar or customers do not cry. How many of us can enjoy such luxury?
Pass phrases are easier to remember. But remembering a pass phrase is one thing, using it is another. We have to remember not just the pass phrase but also the relations between each account and each pass phrase. It is quite a burden for many of us.
A solution of expanding the password system would be to incorporate pictures. But simply being a graphical password is not a solution. If we have to create a pictorial memory afresh from scratch, it may still be difficult to remember if difficult to break and easy to break if easy to remember. It needs something
What we propose is to make good use of episodic image memory.
No comments:
Post a Comment